Security & privacy practices

All traffic between you and Known & Building runs over HTTPS/TLS. Your data is stored on managed cloud infrastructure with encryption at rest, and uploaded files live in private storage that is never publicly listable — files are served only through short-lived signed links generated for your session.

Every table that holds career content is protected by row-level security tied to your authenticated account. Another member cannot read your résumé, opportunities, documents, or files, even if they know the record identifiers.

We do not claim that "even we can't see it," because that would not be true. Known & Building is operated by a small team, and administrative maintenance and support can require access to customer records. That access is limited to authorized administrators, is used only to operate the service or respond to a support request, and is recorded in a durable access log that administrators cannot edit. For the most sensitive operations, access is blocked outright if the log entry cannot be written.

Generating your materials requires sending your career content to third-party AI model providers through our gateway. Content is sent for the purpose of producing your deliverable and returned to your account. We do not sell your data, and we do not use your résumé to train our own models. Model providers operate under their own contractual terms, which we do not control — so we do not make guarantees on their behalf.

Payments are processed by Stripe. Card numbers never touch our servers and are never stored by us. We keep only your subscription status, plan, and renewal dates.

You can delete your account yourself from your account page. When you do:

• Any future subscription renewal is stopped first. If we cannot confirm that with Stripe, the deletion stops and nothing is removed — so you are never left with a charging subscription and no account.
• Your career content and generated files are permanently deleted immediately.
• Payment and legal-agreement records are kept for accounting and legal purposes with identifying details replaced by a non-reversible reference.
• Operational telemetry is stripped of identifiers and expires within 90 days.

Deletion does not refund amounts already paid.

Career content is retained while your membership is active. Operational telemetry is retained for a maximum of 90 days. We do not currently run an automated purge of inactive accounts — deletion happens when you request it, either yourself or through support.

• Known & Building is not SOC 2, ISO 27001, or HIPAA certified.
• We are not zero-knowledge or end-to-end encrypted; authorized administrators can access content.
• We do not guarantee the internal practices of the AI, hosting, and payment providers we rely on.

Email support@knownandbuilding.com. If you believe you have found a vulnerability, please report it there before disclosing it publicly.