jobtrackingapp/docs/ai/safety.md

AI safety and privacy

Local processing is the default. External CV processing is opt-in and gated; provider selection and task type are recorded in the AI interaction/usage paths. The sidecar is private to the backend network in Compose, requires AI_SERVICE_TOKEN on protected endpoints, runs with reduced container privileges, and bounds parser work.

Known limits: local tests do not prove provider equivalence, production privacy configuration, or real outage behavior. Do not paste personal CVs, tokens, or provider responses into audit notes. See security notes for open verification gates.