Methodology

How Cipher works, and why it works that way

Cipher's account of how it works, written for someone deciding how far to trust what it tells them.

What this document is

This is Cipher's account of how it works and why it works that way. It is written for one reader: someone deciding how far to trust what Cipher tells them.

It is not a brochure and it is not a manual. It does not explain how to use the product, and it does not promise the product will get you a job. What it does is set out, for each thing Cipher does to a record, a resume or a score, the reasoning behind it and the evidence where there is evidence, and then say where that evidence stops.

How to read a source here

Every source is labelled in the sentence that uses it, by what kind of thing it is. Some of the evidence is peer-reviewed research. Some is a working paper nobody has refereed, and the sentence says so. Some is a poll published by a company that sells to the people it polled, and the sentence says that too. Where Cipher has made a decision with no evidence behind it, the document says it is a decision rather than dressing it in a citation. The last section lists every source, what kind each one is, which version was read, and which of them are less independent of each other than a count would suggest.

Where this document says Cipher does something, or does not, it is stating a rule Cipher holds itself to. It is not a report on what one screen happened to show the day the sentence was written. Where a number is Cipher's own rule, such as how long a resume may run, the number is printed. Where a number lives somewhere else, on a pricing page or inside a score's own disclosure, this document points there rather than keeping a second copy that could go stale.

What Cipher will not claim

Every section says, beside its evidence, what that evidence does not reach and what Cipher therefore will not tell you. Those refusals are not the caveats of this document. They are its spine, and the section before the last collects them in one place.

What actually filters people out

The number you have probably been told

Somewhere in your search, someone has told you that most resumes are thrown out by software before a person ever reads them. The usual figure is 75%.

In 2025 a study went and asked 25 US recruiters about that claim. It reports that the figure circulates with no source and no supporting data behind it. Asked where they had met it, 68% pointed to job seekers repeating it on social media, 20% to career coaches and resume blogs, and 12% to media headlines with no citation.¹ That study is a vendor-published interview study of 25 recruiters, and its authors state plainly that it is intentionally small and not nationally representative.

We cannot tell you where the 75% started. Nobody who has looked has been able to.

The same is true of review time. Reviewers do move fast. But the precise seconds-per-resume figures in circulation do not trace back to a study you can go and read for yourself, so we will not print one.^2, 3

What Cipher does differently: Cipher does not print a rejection rate, and holds itself to that wherever it speaks to you: not on the landing page, not inside a score, not in an email. A number we cannot source is a number we will not sell you.

The software mostly sorts. People mostly decide.

Where anyone has actually measured what these systems are configured to do, the answer is not automatic rejection.

In the 25-recruiter study above, 23 of 25 said their systems do not auto-reject resumes for formatting, content or design. Two of 25 had content-based auto-rejection configured, on Bullhorn and BambooHR, set to reject below a match or experience threshold. The report puts that 8% at plus or minus 6 points at 90% confidence.¹

A 2026 poll of 1,000 US hiring managers, run on the Pollfish panel by a resume-builder company and published without a field date, found 49% still personally review resumes and use the tracking system to flag, rank or organise them, 37% let the system screen applications out against criteria they set themselves, and 19% use AI to purposefully screen applications out before a human review.³ It is a vendor poll, not peer-reviewed, and we cite it as one.

The largest employer survey in our evidence base reaches the same conclusion about the mechanism: the culprit is human-configured filter criteria and over-specified job descriptions, not autonomous algorithmic rejection. Its recommendation to employers is to stop excluding everyone missing X and start surfacing everyone who has the core skills.⁴ That report surveyed 2,275 executives across Germany, the UK and the US. It is not peer-reviewed, and it is co-authored with a consultancy that sells talent services.

So the filters are real. They were written by a person, they reflect what that person thought the job required, and a human reviewer is usually still in the loop.

What Cipher does differently: we do not sell you a way to beat a machine, because the thing standing between you and a reader is mostly not a machine. Cipher works on the criteria a person set.

What you are actually competing with is volume

Recruiters in that 25-person study estimated that entry-level and administrative openings draw 400 to 600 applications each, customer service and remote support roles often pass 1,000 in the first week, and technology and engineering roles, especially remote ones, can reach 2,000 before screening even begins. Specialised and senior roles stay under 200 and are vetted more deeply.¹ These are combined recruiter estimates from 25 interviews, not labour statistics.

What that does to a job seeker is measurable. In the employer and worker survey above, workers who had been screened out of the market reported, over five years, 25 applications leading to 5.3 next-round invitations and 1.6 full-time offers. The self-identified long-term unemployed applied more than anyone, 44.2 applications, and received 1.2 offers.⁴ Eighty-four per cent of those workers found the application phase difficult, and 24% of the higher-skilled among them said the process led them to stop applying for a while.⁴

More applications is the obvious response and it is not working.

What Cipher does differently: Cipher is built for depth, not for volume. Your allowance is deliberately finite. Cipher runs an alignment check against a role before you spend the work of building for it, so the effort goes into the roles that are worth your time rather than into more of them.

The filter that catches you was often written without much thought

Here is the part that is rarely said out loud. The job description you are being measured against is frequently not a specification. It is a copy of the last one.

Asked how they create a new posting for a middle-skills role, 72% of employers said they reuse an existing posting or modify it only slightly, 19% significantly modify a template, and 8% write a new description. For high-skills roles, 38% reuse or barely change it, 35% significantly modify, and 25% write something new.⁴

And employers know their own postings overstate. Forty-seven per cent said only half or fewer of their middle-skills hires met all the requirements listed in their own job postings. For high-skills hires, only 21% said all their hires met all the requirements.⁴

Meanwhile 78% of business leaders estimated that half or more of middle-skills candidates are eliminated by filtering, and 80% said the same of high-skills candidates.⁴

Put those together. Requirements accumulate in a document nobody re-derives, most hires do not meet all of them, and candidates are cut against them anyway.

What Cipher does differently: Cipher takes a job description apart into the separate things the employer says it needs, and works against those needs one at a time, rather than matching your resume to the posting as a single document. A later section describes how.

There is no such thing as a strong resume in general

Resume content matters. In a field experiment sending resumes to real vacancies for entry-level business and allied-health roles, the authors reject, across nearly all of their models, the hypothesis that callbacks were equal across the work-history and skill templates they sent, in a set of resumes built to look as similar as possible. Their reading is that employers respond closely to differences in resume content. The templates were randomly assigned, so this is causal, within that band of roles.⁵ Peer-reviewed, American Economic Review.

But content matters relative to what the employer is looking for, and outside that, it can stop mattering entirely.

The cleanest demonstration in our evidence base is an accident. Researchers ran a resume-rating study with employers at one university, then ran the identical study at a second. At the first, an extra grade point moved employer interest by 2.196 points (SE 0.129) on their rating scale. At the second, the same variable moved it by 0.265 (SE 0.113), roughly one-tenth. The top internship fell from 0.897 to 0.222. A third of the second university’s resumes received the lowest possible rating, against 15.5% at the first. The diagnosed reason: those employers were recruiting for specific majors, and 33.7% named candidate major among their most important considerations, against 15.3% at the first school. Splitting on whether a candidate was in a target major, grades moved interest by 0.938 (SE 0.268) inside the target and −0.196 (SE 0.240) outside it, and employers did not respond strongly to any variable for candidates outside their target majors.² Peer-reviewed, American Economic Review. Its limits matter: the employers recruit through campus relationships and, as the authors say, would be unlikely to respond to cold resumes at all; the resumes were hypothetical and known by the raters to be; and the rating scale has no established mapping to a real callback decision.

Outside the need, none of the quality signals registered.

And more is not automatically better. In the published table of a resume audit study, adding computer skills moved the probability of a callback by −0.2 (SE 0.01) across all resumes, while special skills moved it +0.4 (SE 0.01) and honours +0.4 (SE 0.02); the joint test that all resume characteristics have no effect is rejected at 54.50, p = 0.0000.6 Peer-reviewed, American Economic Review, Table 5. In a different study, at a bank’s phone centre hiring for one entry-level role, applicants who reported a higher wage on their last job were less likely to be interviewed, at −.027 (SE .009) in the fitted model, and the recruiters said why in interviews: they read it as overqualification and expected turnover. At the offer stage, no skill measure and no education measure remained significant at all.⁷ Peer-reviewed, American Journal of Sociology, and narrow by design: one firm, one job, applications from 1995 and 1996, in a local labour market where unemployment stayed under 4%.

What Cipher does differently: Cipher does not score your resume for general strength, and it does not reward listing more. It scores evidence against a stated need. A skill that is not being asked for is not a point, and in at least two of these studies it cost something.

Employment gaps

A correspondence audit sent applications with unemployment spells of 0, 4, 12, 24 and 52 weeks. Mean callback rates were .101, .099, .111, .108 and .100, and equality across the treatments could not be rejected, p = 0.53 overall. The duration variables were never jointly significant in any specification.⁸ That is an unrefereed working paper, and its applicants were college-educated women aged 35 to 58 applying to administrative support work, so it is not a finding that gaps never matter anywhere.

Set beside it: 48% of surveyed employers whose organisation uses a recruitment management system said they filter middle-skills candidates on employment gaps of more than six months. That is across all three countries surveyed, and it is a practice among the employers who use such a system.⁴

Both are true, and they are about different things. One is a measured outcome. The other is a rule someone configured. A configured rule is not evidence that the gap made you a worse candidate.

What Cipher does differently: Cipher records a gap and never scores it as a penalty. Eligibility rules that an employer has actually configured are surfaced to you as facts about the posting, not folded into a number about you.

The largest single influence on whether an application goes anywhere may not be the document at all. It is how the application arrived.

Section 2: endnotes

Enhancv (2025/2026), Does the ATS Reject Your Resume? 25 Recruiters Explain What Really Happens. Vendor-published qualitative interview study, not peer-reviewed; n = 25.

Kessler, Low and Sullivan (2019), Incentivized Resume Rating: Eliciting Employer Preferences without Deception, American Economic Review 109(11), 3713–3744. Peer-reviewed journal article.

Resume Genius (2026), 2026 Hiring Insights Report: ATS, AI, and Employer Expectations. Vendor poll, not peer-reviewed; n = 1,000 US hiring managers.

Fuller, Raman, Sage-Gavin and Hines (2021), Hidden Workers: Untapped Talent. Harvard Business School Project on Managing the Future of Work with Accenture. Employer survey with disclosed methodology, not peer-reviewed, co-authored with a consultancy that sells talent services.

Deming, Yuchtman, Abulafi, Goldin and Katz (2016), The Value of Postsecondary Credentials in the Labor Market: An Experimental Study, American Economic Review 106(3), 778–806. Peer-reviewed journal article.

Bertrand and Mullainathan (2004), Are Emily and Greg More Employable than Lakisha and Jamal?, American Economic Review 94(4), 991–1013. Peer-reviewed journal article.

Fernandez, Castilla and Moore (2000), Social Capital at Work: Networks and Employment at a Phone Center, American Journal of Sociology 105(5), 1288–1356. Peer-reviewed journal article.

The Career Record

The record comes before the resume

Most resume tools start with a resume. You upload the document you already have, and everything the tool knows about you is whatever that document happened to say. If it undersold you, the tool inherits the underselling and polishes it.

Cipher starts one step upstream. Before there is a resume there is a Career Record: an account of what you have actually done, built through conversation rather than typed into a blank page. Roles, dates, projects, decisions, the work you did that never reached a resume because it did not occur to you that it counted.

Two rules govern how that record relates to a resume, and the rest of this section is the reason for both.

The first is direction. Evidence moves from the record to a resume and never the other way. Anything Cipher captures about you lands in the record first. Nothing is written straight onto a document you send out.

The second is authorship. Anything you write is yours the moment you write it. Anything Cipher writes down on your behalf, by whatever means, is Cipher’s wording until you have read it and confirmed it. The next section describes how confirmation works and what it gates.

The reason for both rules is that the distance between what a person has done and how that work gets described is large, it is measurable, and it is not the person’s fault.

Equally good performances get described differently

The cleanest measurement of that distance comes from a working paper that has not been peer-reviewed, and whose own front matter says so. Participants took a 20-question ASVAB maths and science test. They then answered questions about their own performance, knowing that one answer, and only that answer, would be shown to an “employer” deciding whether to hire them and at what wage. Comparing equally performing men and women, with fixed effects for every possible test score, women’s answers were 12.68 points lower (SE 2.96) on the 0 to 100 statement I performed well on the test. They were 0.59 lower (0.13) on a six-point performance bucket, 15.31 lower (3.46) on I would apply for a job that required me to perform well, and 15.09 lower (3.46) on I would succeed in a job that required me to perform well. All at p < 0.01, on 302 participants in the first wave.¹

The obvious explanation is that people do not know how they did. The paper tests it. Participants were told exactly how many of the twenty they had answered correctly and where they stood against a hundred other people. The gap narrowed and did not close: 7.01 (2.90), 0.40 (0.13), 10.73 (3.40) and 11.73 (3.30) on the same four questions. Pooled across every version of the experiment in which people evaluated their own maths and science performance after being given that information, on 2,990 participants, the figures were 9.83 (0.94), 0.47 (0.04), 15.12 (1.08) and 15.59 (1.07), all at p < 0.01. By the paper’s own account, information reduces the gap by 10 to 31 per cent and never removes it.²

The second obvious explanation is that this is about incentives, and the paper tests that too. A version of the experiment removed the employer entirely and paid a fixed bonus no matter what anyone said. The gap was just as large: 13.46, 0.56, 17.57 and 16.46, all at p < 0.01, on 304 participants. Both men and women answered more favourably when an employer was watching, and they responded to that incentive to the same degree.³

What the gap is specific to matters as much as its size. When the same people evaluated someone else who had scored the same, it very largely disappeared: 0.29 (1.58), −0.11 (0.08), −3.54 (1.69) and −3.17 (1.68), small and mostly not significant. When they evaluated their own performance on a verbal test rather than a maths and science one, none of the differences reached significance in either condition.⁴ This is not a finding that some people describe themselves worse in general. It is a finding about describing your own performance on one kind of task, and it is not a finding about resumes.

One more figure from that study is worth carrying, because it settles which way the error runs. The participants were drawn from online labour markets, with a median age of 33 and a median education of a bachelor’s degree, and 59 per cent of them were men. Women answered 9.94 questions correctly on average against men’s 9.34, a difference significant at p < 0.01. Women, in other words, performed better. Meanwhile the men believed they had answered 11.05 and the women believed they had answered 8.77, also at p < 0.01.5 The gap in self-description ran opposite to the gap in performance.

What Cipher does differently: Cipher does not ask you to rate yourself, and it does not coach you toward stronger language. The Career Record is built by asking what happened. What you did, when, with whom, and what came of it. Those are questions you can answer accurately. How good were you? is a question this research says people answer inconsistently even when they have been handed the answer.

What gets invented is what gets caught

There is a second reason the record has to be an account of real work rather than a place to put your best foot forward, and it comes from a peer-reviewed study of what candidates say they do in job interviews.

Its fifth study asked 751 people about the tactics they had used. The comparison that matters covers 574 of them: 400 who succeeded at interview and received an offer, and 174 who succeeded at interview and were then eliminated during post-interview verification. The eliminated group scored higher on all four deceptive scales. Extensive image creation, the study’s term for inventing experience, ran at 2.20 (SD 1.16) against 1.87 (1.16), F = 10.66. Slight image creation ran 2.39 against 2.04, F = 12.81. Deceptive ingratiation ran 2.73 against 2.44, F = 9.21. Image protection ran 2.38 against 2.02, F = 13.49. All at p < .01.6

The same table carries the other half of the finding, and the two belong together. Of the honest tactics, only honest self-promotion separated the two groups at all, at 3.85 (0.92) against 3.68 (0.93), F = 3.92, p < .05. That is the smallest effect in the table.⁷

Both figures come with real limits. The tactics are self-reported and so is the outcome, the participants were recruited through an online work platform, the authors did not identify what methods produced the eliminations, and the comparison sets aside the study’s two other outcome groups.

Read together, the pattern is narrow and useful. Invention was not caught in the room. It was caught one stage later, after the candidate had cleared the interview and invested in the process. And honest self-promotion was not a strong positive signal on the way in. It was barely a signal at all.

What Cipher does differently: every bullet on a Cipher resume comes from the Career Record rather than being invented for the occasion. Where a posting names something you have done in a word you did not use, Cipher may adapt the wording so the bullet uses that word, and only where the experience genuinely was that thing. What it will not do is stretch a bullet toward a requirement you did not meet, or put a claim on the page that your record does not carry. Cipher will not make a claim on your behalf that you would not make yourself, because the point at which an invented claim costs you is the point at which you have already spent weeks on the process. A later section covers how bullets are composed and what happens to length.

The document and the person come apart

The third strand is the one that decides what Cipher is for. Three studies, three designs, three markets, and the same shape in each: the written document and the person behind it are only loosely attached.

The first is a peer-reviewed field study of one Canadian university’s co-operative education programme in 2024, where roughly 900 students applied into a pool of about 6,000 advertised work-term jobs. The analysed sample is 183 students who secured a position and consented, with the regressions running on 124 and 122 of them, and the researchers were never permitted to see the resumes and cover letters themselves. They worked from ratings made by co-op staff. Resume writing quality, rated for detail, clarity and structure, was not significantly associated with the student’s prior grades, their work experience, their volunteer experience or how tailored the document was. Cover letter writing quality was strongly related to tailoring (r = .49, p < .001) and unrelated to everything else. The two writing-quality ratings barely tracked each other at all, at r = .19 (p = .015). The authors’ own conclusion is that organisations are deciding on a signal that does not track applicant experience or achievement, and their recommendation is that organisations lean less on resumes and cover letters and more on tests, application forms and other tools aimed at skills that can be checked.⁸

The second comes from a set of peer-reviewed field experiments on an online labour market, run with workers in the Philippines on routine clerical and administrative tasks. Workers who had been hired were asked to refer people they knew. When the researchers added controls for everything on the referral’s own profile, the effect of how well the referrer knew the person went up rather than down, and the reason the authors give is direct: the referrals with the strongest ties to their referrers had lower prior earnings, less time on the platform and fewer educational degrees. Their reading is that a referrer recommending someone they know well is picking a person who does not look as good on paper but who performs well in ways the paper record would not predict.⁹

The third is a peer-reviewed field experiment on a different online labour market, where 480,948 people registering between 8 June and 14 July 2021 were randomly assigned, half of them to writing assistance on their profiles. The assistance was not generative. It underlined errors and offered suggestions, and it could not write text. The best three deciles of writers saw no effect at all. The effect rose steadily as writing quality fell, and the worst decile saw roughly double the average.¹⁰

Put the three together. Writing quality did not track the record behind it. The people carrying the most information about how someone would actually perform were attached to the weakest paper record. And where writing help changed anything, it changed things for the people whose description of their work was furthest behind the work.

That is the whole argument for building a record before building a resume. The place people differ is not the work. It is the account of the work. Nobody needs to become a more impressive person to be described accurately, and the fix is not to describe yourself harder.

What Cipher does differently: Cipher’s job is capture, not embellishment. The Career Record is an instrument for getting what you did onto the page, in language you would use and can stand behind, so that the document and the person stop coming apart. Cipher does not close that gap by making you sound better. It closes it by writing down what was already there.

Section 3: endnotes

Exley and Kessler (2019, revised May 2021), The Gender Gap in Self-Promotion, National Bureau of Economic Research Working Paper 26345. Working paper, not peer-reviewed.

Bourdage, Roulin and Tarraf (2018), “I (might be) just that good”: Honest and deceptive impression management in employment interviews, Personnel Psychology 71(4), 597–632. Peer-reviewed journal article.

Pallais and Sands (2016), Why the Referential Treatment? Evidence from Field Experiments on Referrals, Journal of Political Economy 124(6), 1793–1828. Peer-reviewed journal article.

Wiles, Munyikwa and Horton (2025), Algorithmic writing assistance on jobseekers’ resumes increases hires, Management Science 71(12), 10144–10164. Peer-reviewed journal article.

The master resume, and confirmation

The section before this one was about building a record of what you have actually done. This one is about the page that record lives on, and about the single decision that governs everything downstream of it.

Everything you have is on one page

Your master resume is where everything Cipher has captured about you lands. Roles, bullets, skills, certifications, education, projects, and the sections you fill in yourself. Items arrive there however they were captured: pulled out of a document you uploaded, produced by a conversation, or typed in by you.

It is not a document you send to anybody. It is a workspace. Its job is to show you what you hold, not to be presentable.

That has one consequence worth stating on its own. Cipher leaves nothing off that page because it was unsure about it. An item you have not looked at yet is there, whole and visible, exactly as it was captured. Cipher does not hold things back pending your approval, because a page that quietly withholds what it is unsure of teaches you that the page is complete when it is not.

Confirm, edit, delete

For any item you have three actions. Confirm it, which says you have read it and you stand behind it. Edit it, which is you rewriting it in your own words. Delete it, and it is gone.

Leaving an item alone is not a fourth action, and Cipher does not treat it as one. An item you have not acted on is neither confirmed nor removed. It stays exactly where it is, for as long as you like. Nothing is dropped from your record for want of a decision.

The gate sits at the exit

Confirmation does one job. It governs what leaves the master.

Nothing you have not confirmed goes into the pool of evidence you choose from when you build a resume for a particular job, and nothing you have not confirmed goes into a generated resume.

Where that gate sits is the whole of the design, so it is worth two sentences on the alternatives. Filtering at the end, at the moment the document is composed, would offer you unconfirmed evidence, let you pick it, and then drop it on the way to the page. You would choose something and it would not appear, which is a broken product rather than a careful one. Filtering at the front, refusing to record anything until you had confirmed it, would lose things.

So the gate is neither at capture nor at composition. It is at the exit, and every part of Cipher that reads your record for any purpose other than showing it back to you reads through it. The refusal happens on the server rather than by hiding a control, because a control you cannot see is a visual effect, and the rule is what the system does when it is asked.

Who wrote it decides its state

Anything you write is confirmed by the act of writing it. You typed the sentence, so you have already stood behind it, and there is no second step in which you confirm your own words.

Anything Cipher writes or rewrites on your behalf comes back to you unconfirmed. That covers text pulled out of a document you uploaded, text that came out of a conversation with you, and a bullet Cipher has rewritten.

The test is authorship, not the machinery. That is deliberate. A list of the specific ways Cipher might produce text would eventually miss one, and the one it missed would be the one that put words in your mouth without asking.

The place you are most likely to meet this is a rewritten bullet. If you ask Cipher to improve how a bullet reads, what comes back is an offer, not an edit. Your bullet stays as it was until you choose the rewrite, which is shown to you in full first, and choosing it is confirming it. You can also put back the wording you had before. Being offered a rewrite you cannot undo is not being offered a choice.

Roles are containers, not claims

Confirmation attaches to claims. A bullet is a claim you are making. A job you held is the structure a claim sits in, and it carries no confirmation state at all. You can edit a role, delete it, split one into two or merge two into one, whenever you want, and a role you have not touched is not waiting on you.

Everything else in your record is a single thing and gets edit and delete only. A certification is not two certifications that need pulling apart. If the same item appears in your record twice, Cipher put it there twice, and that is Cipher’s defect to fix rather than a tidying job handed to you.

Confirmed is meant literally

Cipher calls an item confirmed and never verified, and holds itself to that wherever it describes your record to you. Confirmed means you read it and stood behind it. It does not mean anyone checked it against the world, because nobody did. The next section sets out why that is a reasonable thing to build on rather than a weakness.

The word does not run in the other direction either. Cipher does not treat anything you wrote yourself as a weaker kind of truth. You wrote it, which by the rule above is the strongest state an item can be in.

What leaving something unconfirmed actually costs

It costs that item its place in one resume. It never costs you the item.

Nothing about your confirmation state blocks you. You can paste in a job description and start work with your entire record unconfirmed.

What happens instead is that you are told before you spend anything. Ahead of generating a resume, Cipher shows you what you have left on each thing that is counted, how to get more where a way exists for you, and how many of your items are sitting unconfirmed.

Then one of two things is true. If some of your record is confirmed, the resume is built from that and the rest is left out, and you were told so before you chose. If none of it is confirmed there is nothing to build from, and Cipher refuses before it composes anything at all, rather than producing a document with nothing behind it. A refusal is never charged for, on any meter.

You are told once. Having read what a resume will be missing and gone ahead, you are not stopped again at generation and not handed a reconciliation afterwards. You made that decision with the facts in front of you, and warning you about it twice would treat you as though you had not.

The build station

The section before this one was about your record and what confirming something does. This one is about what happens when you point that record at one particular job.

A job posting is not one thing to be matched

If that is true, then matching your resume to the posting as a single document is the wrong operation. A posting is a list of separate things, written at different times by different people for different reasons, and some of them matter far more than others.

So Cipher takes the posting apart. It reads the job description and produces a list of the individual things the employer says it needs, each one carrying a sense of how central the employer made it sound.

Then it hands that list to you. You read it, you correct it, and nothing further runs until you have. If Cipher misread the posting, that is the moment it costs nothing to fix, and it is the last moment where that is true. Everything downstream is built on this list, so the list is yours before it is used.

What Cipher does differently: the first thing Cipher shows you about a job is what it believes the job is asking for, and the first thing you do is tell it where it is wrong.

One need at a time

For each thing on that list, Cipher goes into your own record and brings back what might answer it, ordered by how well it seems to fit.

Two kinds of thing come back. Bullets from your history, and skills you have confirmed. Passages from your Career Record, meaning things you said in conversation that never became a bullet, are read too. They are not offered to you here as candidates. Where they earn their place is the cover letter advisor.

The rest of a resume is a set of things that either exist or do not. Skills. Certifications. Awards. Projects. Publications. Education. There is no question of how to describe them and no version of them that is more or less true. What varies is which of them this particular posting makes relevant, and that is a matching question rather than a question about your work.

Certifications, awards, projects and publications are the part Cipher matches, reading them against what the posting asked for. Skills are shared: you select the ones you want as evidence, need by need, and where the posting calls for a skill you have confirmed, Cipher adds it after the ones you chose. Education is not matched at all. Every entry you have confirmed appears unless you take it off, whether or not the posting mentions it, with one exception: high school is left off once you have finished a college degree.

So “you choose what goes on your resume” is true of the part that describes what you did, and it is not true of the whole page. Cipher would rather say that here than have you assume otherwise.

And nothing you have not confirmed is in that pool at all. What Cipher offers you here is your own record, read back to you against this job: a suggestion and never a complete answer, because Cipher is guessing at relevance, and a thing it did not surface is not a thing you did not do.

Then you choose. Not once for the resume, but for each need in turn, and what you choose is recorded against the need it was answering.

What Cipher does differently: Cipher structures, you select, and Cipher advises. The hardest judgment in the whole process is which of the things you have done belongs on this particular page, and it is the one judgment you can watch being made, because you are the one making it. That is worth saying plainly in both directions. It is more work than pressing a button. It is also the only version of this where the resume that comes out is a document you can account for.

What you chose has a reason, and the reason has a name

Because you chose evidence against a named requirement, everything you put on the resume is attached to the thing you chose it to answer.

What Cipher does differently: you are told what your resume contains and why, before you ever have to explain it to anybody else.

What happens when there is nothing

Sometimes Cipher finds nothing for a requirement. Sometimes it finds things and you look at them and none of them is a good match.

That moment is where most resume tools do their real damage, because the obvious move is to find something adjacent and describe it in language that makes it sound closer than it is. Cipher does not do that, and this is the rule the rest of the build station exists to protect. Cipher never pads an empty requirement with a weak stretch, never rewords unrelated experience into apparent relevance, and never pressures you toward a selection where honest evidence does not exist.

What happens instead is a question. Is this a real gap, or is this something you have done that simply is not in your record yet?

If it is a real gap, you say so and it is recorded as one. A gap is information you are owed. It tells you something true about this role and your fit for it, and burying it would cost you the one thing the exercise was for.

If it is something not yet captured, Cipher starts a short conversation to capture it, and what that conversation produces goes into your Career Record. Not onto the resume. Evidence moves from your record to a resume and never the other way, and a thing you just described is a thing you have not yet read back and confirmed.

A requirement therefore ends in one of three states. Answered, meaning you chose something for it. Gap, meaning you looked and said there was nothing. Or unaddressed, meaning you have not decided yet. That third state is the absence of a decision and never something you do on purpose. Cipher will not give you a button that means “leave this one alone.”

What Cipher does differently: Cipher will not manufacture an answer for you. A requirement with no honest evidence stays a gap, and the gap is reported to you as a fact about this application rather than treated as a hole to be papered over.

Confirmed, never verified

Cipher calls your record confirmed and never verified, and holds itself to that wherever it describes your record to you. The distinction is deliberate. Cipher’s job is to make a real record legible. It is not an authenticator, it did not call your old manager, and a product that implied otherwise would be lying about what it did.

In a 2026 experiment, more than seventeen hundred people with professional hiring experience worked through paired comparisons of fictitious CVs. Where a candidate carried a particular in-demand skill, it mattered that the skill was there far more than it mattered where the claim came from. A university certificate, a company certificate, a platform badge and the candidate simply saying so all landed close together, and the authors read the effect as close to binary: having the skill counts, the source of the claim counts much less. The one place formal certification pulled clearly ahead was where a conventional signal was missing, for candidates with lower formal education, where a university-issued credential produced the largest effect in the study.¹

What Cipher does differently: Cipher calls an item confirmed and means it literally. You read it, you stood behind it, it goes in. Cipher holds itself to that word when it describes your record to you, and will not describe it as verification, because it is not.

Help with how it reads, not with what it says

An earlier section described a study in which writing help mattered most for exactly the people whose description of their work had fallen furthest behind the work itself. That study is Wiles, Munyikwa and Horton (2025), the peer-reviewed field experiment cited in the shortlist strength section. What that help actually was is worth stating here, because it is precise and it is easy to misremember.

The assistance in that study was not generative. It underlined errors and offered suggestions when you hovered over them. It could not be asked for anything, and it could not write text.²

Moving around, and what happens on a bad day

You can move between the parts of this process and come back to what you have already done. Confirming, correcting and selecting are saved as you go, so the work is in your record rather than in the page you are looking at. Where something cannot be picked up where you left it, Cipher tells you at the point it happens rather than letting you find out by losing it. Going back does not cost you what you already did. Nothing you have confirmed, corrected or selected is thrown away because you went to look at something else, and none of it is lost when you close the browser and come back tomorrow. A tool that punishes you for reconsidering is a tool that teaches you not to reconsider.

There is also a rule for the day the machinery does not work. If the step that reads your record against a requirement cannot run, the standard the fallback has to meet is that you go through your own record by hand and keep working. Not a message telling you to come back later.

What Cipher does differently: the part of this that requires a working model is the part that saves you time. The part that produces the resume is you.

Section 4b: endnotes

Stephany, Teutloff and Leone (2026), AI Skills Improve Job Prospects: Causal Evidence from a Hiring Experiment, arXiv 2601.13286, March 2026 version. Working paper, not peer-reviewed; funded by the Microsoft AI Economy Institute.

Wiles, Munyikwa and Horton (2025), Algorithmic writing assistance on jobseekers’ resumes increases hires, Management Science 71(12), 10144–10164. Peer-reviewed journal article.

Composition and length

The section before this one was about choosing evidence, one requirement at a time. This one is about what happens to those choices on the page: how a bullet gets there, how long the document is allowed to be, what Cipher removes to make it fit, and what it tells you it removed.

The last of those is the part you are most likely to be surprised by, so it is here rather than somewhere you would find it afterwards.

A bullet on the page is your work, in your words

Cipher assembles a resume from what you have confirmed, and the place it earns its keep is before that. You tell a story about a project in your Career Record, and Cipher gives you back the line that says what you actually did, the accomplishment you would not have thought to list, in words you would not have reached for. You read it, you change it if it is wrong, and it is yours once you confirm it. What Cipher will not do is invent experience you never described.

That is a narrower claim than it sounds, and it rules some things out that other tools do. Cipher does not combine two of your bullets into one. It does not take three examples of similar work and merge them into a single stronger-sounding line. A bullet on a Cipher resume is a bullet from your record.

There is one thing Cipher does do to a bullet, and it is worth stating exactly. A posting will often name a thing you have done using a word you did not happen to use. Where that is the case, and only where it is genuinely the case, Cipher may adapt the wording so the bullet uses the posting’s term. The test is whether the experience really was that thing. If it was, the change is a translation and you are not being made to look like someone else. If it was not, there is nothing to translate, and Cipher will not stretch a bullet toward a requirement you did not meet, will not inflate what you did, and will not add a claim your record does not carry. That boundary is the whole of it: Cipher may change how your work is worded, never what your work was.

Where Cipher drafts anything on your behalf, the rule described earlier holds: it is Cipher’s wording until you have read it and confirmed it. That includes polish, which is a separate step from composition and not part of it, is capped rather than open-ended, and can be undone. A polished bullet replaces yours only when you choose it, and you can put back the language it had before.

So the composition work is not writing. It is making sure that what goes on the page is specific rather than vague, that it reads clearly, and that the document is organised and clean. That sounds modest. It is the thing that was actually measured.

In a 2025 study of one Canadian university’s co-operative education programme, resume and cover letter writing quality predicted the share of applications that turned into interviews, and predicted how long the search took, with the effects surviving controls for work experience, extracurricular experience, grades, gender, visa status and the success rate of the applicant’s academic programme.¹ The scope of that study is narrow and travels with it: students applying to entry-level work terms, only applicants who secured a position in the dataset at all, and regressions running on 124 and 122 students rather than the full 183. The researchers were never permitted to see the documents themselves and worked from ratings made by co-op staff.

What matters more than the size of the effect is what the raters were rating, because it is easy to assume. The rubric scored detail, clarity and structure. Detail meant specific relevant information rather than vague or generic. Clarity meant coherent description rather than ambiguous or bland. Structure meant organised, error-free text rather than disorganised or error-laden.¹ It was not a measure of prose style, polish, or persuasive writing.

That distinction is the whole reason to state it here. Read carelessly, that study says better writing gets more interviews, and the obvious response is to write more impressively. Read accurately, it says that being specific, legible and organised is what registered.

What Cipher does differently: Cipher’s composition work is aimed at specificity and legibility, not at making you sound better. Cipher will not promise you a percentage more interviews for a better-written resume, and no number from that study appears anywhere in this document, because it was run in one co-operative education market on students who all found positions, and that is not a promise anyone can transfer to your search.

How long a resume is allowed to be

You tell Cipher the maximum number of pages you want. A page means one side.

That number is a ceiling and never a target. If what you selected supports less than the maximum, Cipher gives you fewer pages and tells you that is what happened. It does not pad, stretch, or reach for filler to make a page look full.

The reason to have a ceiling at all is worth stating with its evidence, because the received wisdom on resume length is confidently asserted from every direction.

A 2026 poll of 1,000 US hiring managers, run by a resume-builder company, found 43% saying they will not read a resume longer than two pages, and 57% saying they will read beyond two pages when the information is relevant.² Both halves are the finding. A substantial minority stops, and a majority keeps going when there is a reason to.

Separately, when 25 US recruiters were asked in a vendor-published interview study what they actually value in a resume, one to two pages maximum was named by 64% of them. It ranked below a clear skimmable structure at 92%, relevant experience and skills at 88%, natural keyword use at 76%, and short bullet points rather than long paragraphs at 72%. Those shares add to more than 100% because recruiters named more than one thing.³

Read together, that supports a cap with judgment attached rather than a hard rule. It does not support telling you that a third page will get you rejected, and Cipher does not tell you that.

The same two sources settle two smaller questions about the document itself. On format, only 13% of those hiring managers said layouts with images or heavy design elements are compatible with their systems, against 53% for text-based files with no images or complex formatting.² On structure, 90% said a clear resume summary helps them evaluate faster, 85% expect a skills section, 72% said inconsistent spacing or formatting hurts their perception of a candidate, and 56% said resumes emphasising skills while downplaying work history are harder to evaluate.² All three of those are vendor publications, not peer-reviewed work, and this document says so wherever they appear.

What Cipher does differently: Cipher produces a plain, clean, text-based document with consistent typography, a short summary, a skills section and your work history intact. The design decisions are not aesthetic preferences. They are the things the people who read resumes said made a resume readable, and Cipher would rather hand you something a tired reviewer can scan than something that photographs well.

Cipher cuts, and it does not ask first

Here is the part to be direct about. When your resume comes out longer than the maximum you asked for, Cipher shortens it itself. It does not show you the long version and invite you to trim it. That partnered version is real and it is planned, and it is not what launches.

Removing things from somebody’s resume without asking is a significant thing to do. It is defensible, and the defence is in the next two paragraphs rather than in a disclaimer.

The order is fixed, and it is not a fresh judgment each time. Cipher first resolves places where the same thing is said twice across different roles, keeping the version with concrete numbers first and the more recent one second. If the resume is still over, it drops bullets from roles more than ten years old, one at a time, and stops as soon as the resume fits. A role whose bullets are all removed keeps its title, company and dates, so shortening to the length you asked for never makes a gap appear in your history. Cutting the duplicate comes before cutting the old role deliberately: removing a second answer costs nothing, and removing a ten-year-old bullet may remove the only proof of something.

The rule that makes all of this safe is the one that stops it. Cipher never removes an item that is the only thing on your resume answering one of the requirements you selected against. Not in any step, and not to reach the length you asked for. Where a cut would take out the sole evidence for a requirement, that cut is refused. The one limit that outranks it is the three-page ceiling, described below. This is the constraint the whole automatic path is built around, and it is the reason automatic cutting is not the same thing as arbitrary cutting.

Two smaller rules follow from the same posture. Nothing is removed from a resume that is already within its maximum: the shortening machinery does not run at all on a document that does not need shortening. And shortening is ordinary code, not AI, so it runs the same way every time. Two parts of a build use AI: the read of your record against the job, and the summary. If the read cannot run, you get no resume and are told so, never a resume built without it. If only the summary cannot be written, you are told that too.

What Cipher does differently: Cipher cuts to your requested length by itself, in a fixed order, and never at the cost of the only evidence you have for something the job asked for. The automatic part is the convenience. The refusal is the product.

When cutting has to stop and the resume is still too long

Sometimes preserving every sole answer means the document cannot reach the length you asked for. That is a real outcome and it has a defined ending rather than a silent compromise.

When that happens, Cipher tells you that one or two pages is not enough for your record against this particular posting, states the length it would actually take, and gives you the smallest number of pages that holds it.

That number never goes past three. Where holding every sole answer would take more than three, the ceiling wins. Cipher removes what it added on its own before anything you selected, and among your selections removes first whatever leaves the fewest of your requirements unanswered. A role with nothing left under it can lose its title line at this step too. Cipher stops once the resume fits within three pages, names every removal, and names each requirement it could not represent. Nothing it removed is gone: one action puts it all back, and a resume you restore can run past three pages, because that choice is yours rather than Cipher’s. The one case where Cipher’s own composition runs past three is when removing everything it is allowed to remove still would not get there. Then the ceiling step leaves the resume as it is and tells you so.

What Cipher does differently: the ceiling binds Cipher, and where it binds, Cipher tells you exactly what fell outside it by name. A tool that silently picked which of your requirements to drop would be making the most consequential decision in the process on your behalf and not mentioning it.

What you are told about what was removed

“We shortened your resume” is not an honest sentence. It reports that something happened without reporting what.

So where Cipher has shortened a resume, it says what came off, item by item. Not that it trimmed, and not a count by category, but the repeated bullet it resolved and the four bullets from roles over ten years old, each named. One action puts all of them back. This is the rule that keeps automatic cutting from being a silent edit, and Cipher holds itself to it as a matter of what the product is allowed to say, not as a nice touch.

Where a resume comes out longer than the maximum you asked for, that is one message and not three. Cipher recommends a one-to-two-page resume for an application, says why this one is longer, says what was removed, and says you should read it and decide what else comes out. One block, composed once, rather than a notice for the length and a second notice for the cuts and a third for the recommendation.

That message says the same thing to everybody. It names no industry and no role type for which a longer document is supposedly acceptable, because Cipher does not detect what field you are in and makes no length exception for anyone. An exception that implied otherwise would be a promise the product cannot keep.

What Cipher does differently: you are told what was removed from your resume in the same terms you would use to describe it yourself, and you are told it once, clearly, in one place.

When a posting asks for more than a resume can hold

There is a version of this problem that no amount of careful cutting solves, which is a job description carrying so many separate requirements that no two-page document could answer them all.

Cipher handles that at the beginning rather than the end. When you approve the list of requirements Cipher read out of the posting, if that list runs past a certain size, Cipher stops and gives you a choice: go back and remove requirements you do not want to serve, or proceed knowing that this resume will not have a length you set and will come with a recommendation to cut it down yourself.

The point of putting that moment at the top is that it is the only place where the choice is still cheap. Finding out at the end, after selecting evidence for forty requirements, that the document was never going to fit, is finding out too late to do anything except accept it.

What Cipher does differently: where a constraint is going to bite, Cipher raises it at the moment you can still act on it rather than at the moment it becomes your problem.

Section 4c: endnotes

Resume Genius (2026), 2026 Hiring Insights Report: ATS, AI, and Employer Expectations. Vendor poll, not peer-reviewed; n = 1,000 US hiring managers.

Enhancv (2025/2026), Does the ATS Reject Your Resume? 25 Recruiters Explain What Really Happens. Vendor-published qualitative interview study, not peer-reviewed; n = 25.

Filter probability

Before any person reads your resume, software decides whether it is searchable and a recruiter decides whether to open it. Filter probability is about that stretch.

It is written to stand on its own, and it leans on an earlier section for most of its evidence, because that section already did the work of taking the screening software apart. What that section established is referred to here in a sentence and is not run again.

What this score estimates, and the one question it asks

Filter probability estimates whether your resume reaches a human reviewer intact: read correctly by whatever software sits in front of that person, clear of the eligibility rules the employer has actually set, and carrying the words a person or a search would look for.

Its question is narrow. Shortlist strength asks whether you have what the job wants in an applicant. Career alignment asks whether the job supplies what you want. Filter probability asks only whether the document carries the right words in a form that can be read. That is a question about the document and the posting, and about nothing else.

It is not a percentage chance of getting through, and Cipher does not present it as one. When you run it, Cipher shows you a zone before it shows you a number: significant gaps, partial fit or strong fit. If you want the number, Cipher gives it to you on a scale of zero to ten, together with everything the score weighed, how much each part counted and every caveat attached to it, and any member who runs the score can open all of it. Cipher also never adds this score to, averages it with or blends it into the other two. Why that is a rule rather than a preference is a later section.

What is actually on the other side

Here is what can honestly be said about the software your resume meets, and it is shorter than most advice on the subject.

Companies probably have an applicant tracking system. It probably parses. It may rank or grade what it parsed. And some do none of that.

Anyone who claims to know more than that about a particular employer, or who promises you will get through, is selling you something you should not buy.

Each of those four sentences has something behind it, and none of it is precise enough to turn into a number about you. In a 2025 hiring experiment, 1,725 professionals with direct hiring experience were asked how prevalent tracking systems were in candidate screening at their own organisation. Twelve point one per cent said the system was used for every screening task, 29.5% said frequently, 24.0% occasionally, 13.0% rarely, and 20.3% said it was not used at all.¹ That study is an unrefereed working paper, funded by the Microsoft AI Economy Institute and disclosed as such. A 2026 vendor poll of 1,000 US hiring managers, run by a resume-builder company, put company use of a tracking system at 71%.²

Whether the system decides anything is a different question, and the earlier section on filtering already carries the answer: most reviewers still look, and the criteria that screen people out were set by a person. What that section did not carry is the ranking layer. In the same 2026 poll, 32% said AI recommends or ranks candidates while humans make every final decision, and 6% said it can advance or reject a candidate with limited human review.² Among the 25 US recruiters interviewed for a 2025 vendor-published study, an AI match score was available in 44% of their systems. Thirty-six per cent used it as a guide to triage while still reviewing by hand, 8% used it as a deciding factor, and 56% had the feature off or ignored it.³ Ranking is common. Rejecting on the rank is rare.

That a ranking layer measures something real is the one thing this section takes from the model-screening literature, before a later section takes anything about bias from it. When three open-source embedding models were used to match 554 resumes against 571 job descriptions across nine occupations, resumes from the same occupation as the posting scored measurably closer to it than resumes from a different one, before any name was attached, in every occupation and every model.⁴ That study is a preprint whose models were selected in 2024 and are not what Cipher runs on. It has no employer, no tracking system, no parse step and no hiring decision anywhere in it, and it shares its resume corpus with another study this document cites. What those models did with a name, and why no rate from that literature may be quoted, is set out in full later.

What Cipher does differently: Cipher scores against those four sentences and not against a system it cannot see. Cipher does not claim to know how any particular employer’s software is configured, and it does not sell you a way through it.

The two things that are checked before anything is scored

Two things about a resume are facts before they are judgments, and Cipher treats them as facts. Each is checked in code, and each caps the score when it fails.

The first is whether the document can be read. A resume that a system cannot turn into structured fields, a name, a work history with dates, an education, a list of skills, cannot be evaluated on anything else, because the thing being evaluated has been scrambled. So Cipher builds its documents to be read cleanly in the first place, which the section on composition describes, and checks that its own output can be read back that way. Where it cannot, the score is capped and you are told why. Cipher does not put a number on how often parsing fails in the world, because the honest answer depends on the system on the other side as much as on the document, and neither is a constant.

The second is whether you meet the requirements that are genuinely rules rather than preferences: work authorisation, a licence or clearance the role cannot be done without, a location that is not negotiable. Recruiters in the 25-person study describe these knockout questions as the real automated filter, used for work authorisation, a required licence or certification, and location.³ They are binary, they are job-relevant, and no amount of keyword coverage changes them. Where the posting requires one and your record says you do not have it, the score is capped and the requirement you did not meet is named to you. Where the posting requires one and your record simply does not say, Cipher caps nothing. It flags the requirement and asks you to verify it before you apply, because the absence of a statement is not evidence of a conflict.

A years-of-experience floor, or a degree that reads as a preference rather than a compliance requirement, is not a knockout, for the reason an earlier section gave: most hires do not meet all of a posting’s requirements, and employers say so themselves.

A knockout never stops anything. Your resume still builds, all three scores still compute, and the document is still yours to download. Cipher sits on the candidate’s side of the table. You may have been told to apply anyway by a referral or a recruiter, or you may read the posting as overstating what it needs. Cipher’s job is to tell you where you stand, not to make that decision for you.

One piece of evidence for why these gates are facts rather than quality signals. In a field experiment sending applications to real vacancies, the type of institution that issued a health certificate moved callbacks where the posting did not require a licence, and stopped mattering where it did.⁵ Peer-reviewed, American Economic Review. The authors’ reading is that a required licence gives the employer a signal that displaces inference about the candidate, and they call that reading speculative.

What Cipher does differently: eligibility rules an employer has actually set are surfaced to you as facts about the posting, and they cap the score honestly. They are never folded into a number about your quality, and they never lock you out of your own application.

What the rest of the score is reading

Above those two gates, the score is built from two things: whether the resume carries the posting’s terms, and whether they sit where a reader will find them.

The first is counted rather than judged. The list of needs you approved at the build station is what the resume is matched against, requirement by requirement, and the coverage that results is arithmetic over that list. It is not a model’s opinion of how well the document covers the posting.

Which words count is the part worth being exact about, because “keywords” is the most abused word in resume advice. An earlier section showed that in a resume audit a generic computer-skills line cost a little, while specific, job-relevant skills paid.⁶ A resume-rating study with employers, whose limits that same section set out, found the same shape from the other side: a block of four in-demand technical skills, appended at random, moved hiring interest not at all and directionally negative, and the authors’ reading is that employers treat skills listed on a resume as cheap talk.⁷ Meanwhile, in the hiring experiment above, listing AI skills, one specific and currently demanded category, raised the probability of an interview invitation by roughly 8 to 15 percentage points across three white-collar occupations, and the authors say the size likely varies elsewhere.¹ Cipher’s reading of the difference, and it is Cipher’s reading rather than a finding of either study, is that what registered was specific and relevant to the stated need, and what did not register was simply more. Cipher will not stuff a resume with terms, when the evidence does not support it, and the section on composition and length set out that what recruiters say they value is natural use of the posting’s words.

The second is a judgment, because it has no deterministic substitute: whether the things a reader looks for first, your name, titles, employers, dates and education, are where a reader expects them, and whether the relevant terms land in those places rather than somewhere a scan will miss. The section on composition already set out what readers said made a resume readable. The same poll’s list of why resumes get filtered out is the closest thing in this evidence base to a description of what this score estimates: missing required skills or poor alignment with the job description at 42%, failure to meet basic role requirements at 36%, unclear or incomplete work history at 33%, generic or AI-heavy content at 28%, lack of relevant keywords at 28%, formatting that is difficult to scan at 26%, and too long or dense at 20%.² It is a vendor poll and this document cites it as one. Two things in that list are worth noticing. Skill mismatch outranks length by a wide margin. And generic content ties with missing keywords.

How well the record is written is a different question from whether it carries the right words, and it belongs to the score after this one and to the section on composition, which set out the one study in this evidence base that measured writing quality against real interview rates.⁸ It is not run again here.

What Cipher does differently: Cipher matches the words against the needs you approved, and it adapts a bullet’s wording to a posting’s term only where the experience genuinely was that thing. A term your record does not support does not go on the page to move this score.

What to do with it

Read the gates first. A capped score is telling you a fact, and a fact has two honest responses: fix it where it can be fixed, or decide with your eyes open to apply anyway.

Then read the coverage as a translation question and not a vocabulary test. Low coverage against a need you approved means one of three things. The experience is in your record under a different word, and the section on composition describes what Cipher may do about that. The experience is not in your record yet, which the build station will have asked you about. Or it is a real gap, which is information you are owed and not something to paper over.

Do not read it as your chance. Cipher does not guarantee interviews, jobs or specific outcomes, and a score that could be read as a promise of getting through would be the exact claim this section calls out other people for selling.

What Cipher does differently: every part of this score is labelled with the kind of evidence behind it, and the parts resting on judgment rather than measurement say so where you read them. Cipher would rather hand you a modest, honest estimate with its reasoning open than a confident number built on a system nobody has measured.

Section 5a: endnotes

Resume Genius (2026), 2026 Hiring Insights Report: ATS, AI, and Employer Expectations. Vendor poll, not peer-reviewed; n = 1,000 US hiring managers, Pollfish, no field date given.

Enhancv (2025/2026), Does the ATS Reject Your Resume? 25 Recruiters Explain What Really Happens. Vendor-published qualitative interview study, not peer-reviewed; n = 25.

Wilson and Caliskan, Gender, Race, and Intersectional Bias in Resume Screening via Language Model Retrieval, arXiv 2407.20371v2. Preprint; no published version of record has been consulted here.

Bertrand and Mullainathan (2004), Are Emily and Greg More Employable than Lakisha and Jamal?, American Economic Review 94(4), 991–1013. Peer-reviewed journal article.

Kessler, Low and Sullivan (2019), Incentivized Resume Rating: Eliciting Employer Preferences without Deception, American Economic Review 109(11), 3713–3744. Peer-reviewed journal article.

Shortlist strength

This is the score about the part of the process where a person is reading.

It is written to stand on its own, so nothing in it depends on having read the score before it.

What this score estimates, and what it refuses to

Shortlist strength estimates how well your record answers what a role is hiring for, read the way a human reviewer would read it.

It is not a probability, and it is not an assurance that you will be interviewed. Cipher will not tell you your chance of an interview as a percentage.

When you run this score, Cipher shows you a zone before it shows you a number: significant gaps, partial fit or strong fit. If you want the number, Cipher gives it to you on a scale of zero to ten, together with the whole of the reasoning behind it: everything the score weighed, how much each part counted, and every caveat attached to it. Cipher does not sell that as a paid feature and does not gate it by tier. Any member who runs the score can open all of it.

Cipher also never adds this score to, averages it with or blends it into the other two.

What it is mostly reading

Most of this score is about one thing: whether your record describes your work clearly and specifically.

That is the part with real evidence behind it, and it is the only part of any Cipher score resting on a causal study rather than an association. Roughly 480,000 people registering on an online labour market over five weeks in 2021 were randomly assigned, half of them to writing assistance on their profiles. The assistance underlined errors and offered suggestions. It could not write text and could not be asked to. Treated jobseekers were 8 percent more likely to be hired in their first month.¹ Two of the authors received funding from the platform, and say so in the paper.

The finding that gives that one its meaning is the one nobody quotes. Employers were no more satisfied with the people they hired. Nothing moved on private ratings, on public star ratings, on review sentiment, on hours worked, or on rehires, in an analysis powered to rule out all but the smallest effects.¹ The writing help did not make anybody better at the work. It made the account of the work legible enough to be chosen.

An earlier section recorded the other half of that result, the part about who benefits: the best three deciles of writers saw no effect at all, and the effect grew as writing quality fell.¹

No figure from that study appears in this document. The thing tested was error-underlining on one platform, and Cipher is not that. What carries across is the mechanism, that clarity changed who got chosen. The size of the effect does not carry across, and anyone offering you a percentage improvement is offering you something the research does not support.

The second study is the one the section on composition and length already set out, and the same restrictions travel with it. In a Canadian university’s co-operative education programme in 2024, how well students’ resumes and cover letters were written predicted the share of their applications that became interviews and how long the search took, and what the raters were rating was detail, clarity and structure rather than prose style.²

What Cipher does differently: this part of the score is about whether your record reads clearly and says something specific. It is not about whether it reads impressively. And Cipher makes no promise about what a clearer record will do for you, because the only causal study available found the benefit landing almost entirely on the people whose writing was furthest behind their work.

Why Cipher will not write your resume for you

Cipher does not generate your experience. It does not invent claims, and it does not produce prose on your behalf that you would then have to defend in a room.

There is one thing it does do to the words, and it is worth being exact about, because the difference between these two is the whole of Cipher’s position. Where a posting names something you have done using a word you did not happen to use, Cipher may adapt the wording so the line carries the posting’s term, and only where your experience genuinely was that thing. It may change how your work is worded. It never changes what your work was. It will not stretch a line toward a requirement you did not meet, and it will not add a claim your record does not carry.

That is a decision rather than a limitation, and there are four separate findings behind it, none of which depends on the others.

The first is that the tools improved documents and damaged their credibility in the same movement. In a 2026 poll of 1,000 US hiring managers by a resume-builder company, 79% said resumes are more polished than they were five years ago and 78% said they are better tailored. The same respondents, in the same survey: 77% said many resumes now appear completely or partially AI-generated, 69% said resumes are more generic or formulaic than five years ago, 76% said AI-written resumes make it harder to understand what a candidate actually did, and 72% said heavy reliance on these tools makes candidates seem less skilled.³ Both halves are the finding. Neither one is usable without the other.

The second is what hiring managers say they would rather have. An online panel of 3,000 managers fielded in August 2024, published by a resume-builder company, reports that a majority express a preference for a poorly written but authentic resume over a perfectly polished generated one, and that a minor typo or an awkward sentence can read as authentically human. No figure is attached to that claim anywhere in the report, and none is invented here.⁴

The third comes from the causal study above, and it is the one Cipher takes most seriously, because it is the only source in this set that measured anything. Its authors decline to generalise their result to generative tools at all. Their stated reason is that a model writing a resume with far less input from the jobseeker may produce a less informative document, and they expect this class of tool to erode writing as a signal of ability.¹ The study that found writing help works says, in its own text, that it is not evidence for the tools that write.

The fourth comes from a source with every commercial reason to say something else. A staffing firm published a survey of more than 2,000 US hiring managers in a press release, and the release’s own remedy for the problem it describes is to hire a staffing firm. Its method is thinner than the polls above: no sampling frame, no panel named, no margin of error. Inside it is a passage that cuts against its framing, stating that not all AI-assisted applications are inaccurate or misleading, that many candidates use these tools responsibly to improve clarity and grammar, and locating the employer’s problem in volume and unverifiability rather than in AI use as such.⁵

Three methods, one line. A randomised experiment found the writing help changed who was hired without changing how they performed. A poll finds recruiters holding better documents they trust less. A staffing firm says the problem is not the tool.

What Cipher does differently: Cipher assembles from what you have actually done and puts it in words you can stand behind, and where it adapts a phrase it adapts only the phrasing. This is a position, not a missing feature. Cipher could generate your resume and has decided not to.

And why it does not test whether a machine wrote it

There is a version of the above that Cipher deliberately did not build: scoring you on whether your text looks machine-written.

Part of this score does read for whether your record sounds like a particular person doing particular work rather than like anyone doing anything. That is not the same as a detector, and the distinction is not academic, because the evidence on detection does not support scoring anybody on it.

In a 2023 poll published by a resume-builder company, hiring managers were shown three cover letter introductions and asked which were written by a person and which by ChatGPT. Eighteen per cent identified all three correctly.⁶ Every part of that is narrow: cover letters rather than resumes, all three correct rather than per item, so accuracy on any single item is necessarily higher and was not reported. And the panel had been screened down to people who already believed they had reviewed AI-written material, which makes this a floor on the gap between confidence and accuracy among people confident they can spot it, rather than an estimate of anything about hiring managers generally.

A different survey measured a different thing. In the 2026 poll, 80% of hiring managers said they can often tell when a resume was written by AI, and only 4% said they notice no signs at all.³ That is what people report believing about themselves. It is not a measurement of whether they are right, and it does not belong on a scale with the figure above.

A third measured something different again: roughly half the managers in the 2024 panel said they would automatically dismiss a resume if it were AI-generated.⁴ That is a stated disposition, not a record of what they would detect.

The most useful of these is the least statistical. Asked what gives a document away, the 2026 respondents named unnatural phrasing or tone at 51%, repetitive or overly generic language at 44%, vague or inflated descriptions at 41%, buzzword-heavy writing at 41%, perfect grammar with no variation at 39%, particular formatting habits at 32%, and incorrect or irrelevant details at 27%.³ Read that list and notice what is not on it. Almost nothing there is a technical fingerprint. Nearly every item is a way a document can stop carrying information about a particular person.

What Cipher does differently: Cipher holds itself to one rule here: it does not test your record for machine writing, and it does not build a score that does. What it reads for is substance, which is concrete work described specifically in language that is recognisably yours. What it discounts is generic polish. You will never be marked down for having had help with the writing, which would in any case be Cipher marking you down for using Cipher.

The smaller things it weighs, and the one it refuses to

A formal referral that has actually entered an employer’s process counts for something, as a small addition that can only raise a score and never lower one. A conversation with someone at the company, or a mention that never became a referral, counts for nothing, and you are never marked down for having made the call. A connection cannot rescue a role that is wrong for you. The evidence that sets that shape, and the reason no number from the referral research appears anywhere in this document, is a later section.

There is also a small allowance for how well your experience matches what a role is really centred on rather than only what it lists. This is the weakest thing in the score and it is treated as such. It is a model’s inference about priorities the employer never wrote down, and Cipher bounds it structurally rather than trusting it to be small: your zone is worked out without it, and it can then only strengthen or soften the result inside that zone. It cannot, on its own, change which zone you are in. A referral is allowed to move you across that line and this is not, because one of them is a fact you reported and the other is an inference, and the more trustworthy signal gets the more consequential power.

And there is one thing this score names and refuses to score at all: reviewer-side effects Cipher cannot mediate, which Cipher discloses to you as a stated limit and gives no weight whatever, because scoring them would mean putting a number on your likely exposure to discrimination. Why no such number could be honest is set out in full later.

What Cipher does differently: the two weakest signals here are the two smallest, one of them cannot change your verdict by construction, and Cipher’s rule for the thing it refuses to quantify is to tell you about it, never to drop it in silence.

What Cipher promises about the reasoning it shows you

Every part of this score is labelled with the kind of evidence behind it, not only with how much it counted. Clarity of writing is the one part labelled from causal research. The match against a role’s unstated priorities carries the weakest label of all of them, and it says so in the same place it shows you its influence.

The weighting itself is provisional and is published as provisional. Two things are expected to move it. One is new research: something resting on reasoned judgment today can be re-anchored when better evidence arrives. The other is Cipher’s own outcome data, which is why the separate parts of the score are kept and not just the total, and why the weakest part is tuned against whether a first interview becomes a second rather than against callbacks alone. Any change routes through the same process as every other decision described in this document.

What Cipher does differently: the reasoning is open, to every member, and it is labelled honestly rather than presented as settled. A member who reads it and disagrees is doing the thing publishing it was for.

Section 5b: endnotes

Wiles, Munyikwa and Horton (2025), Algorithmic writing assistance on jobseekers’ resumes increases hires, Management Science 71(12), 10144–10164. Peer-reviewed journal article.

Resume Genius (2026), 2026 Hiring Insights Report: ATS, AI, and Employer Expectations. Vendor poll, not peer-reviewed; n = 1,000 US hiring managers, Pollfish, no field date given.

Resume.io (2025), Study: 49% of hiring managers reject AI-generated resumes. Vendor poll, not peer-reviewed; online panel of 3,000 managers fielded August 2024.

Robert Half (2026), Robert Half survey: 67% of HR leaders report AI-generated applications are slowing hiring, press release, March 10 2026. Vendor poll inside a press release published by a staffing firm, not peer-reviewed; more than 2,000 US hiring managers, November 2025; no sampling frame, panel or margin of error disclosed.

ResumeBuilder.com (2023), 82% of Hiring Managers Unable to Identify Cover Letters Written by ChatGPT. Vendor poll, not peer-reviewed; n = 1,000 US, Pollfish, fielded March 2023, double-screened.

Career alignment

Career alignment is the one score that asks your question instead of the employer's: whether this role supplies what you said you wanted.

What this score estimates, and whose question it asks

Career alignment estimates whether a role supplies what you have said you want.

It is not a probability that you will be satisfied in the job, and Cipher does not present it as one. When you run it, Cipher shows you a zone before it shows you a number: significant gaps, partial fit or strong fit. If you want the number, Cipher gives it to you on a scale of zero to ten, together with everything the score weighed, how much each part counted and every caveat attached to it, and any member who runs the score can open all of it. Cipher also never adds this score to, averages it with or blends it into the other two. Why that is a rule rather than a preference is the next section.

What it is built from

The score is assembled from three parts, and each asks a different question about the same role.

The first asks whether the role fits the goals you stated. That is a reading of the posting against what you said you want from your next role, and it is a judgment about language: whether a description of the work matches a description of what you are looking for. A model makes that judgment, and code turns it into a number by a rule written down in advance. It is the part of the score that carries the most weight, and the reason is in the evidence below.

The third asks whether the role meets the preferences you stated: a pay floor where you set one, a location, an arrangement such as remote or on-site, a target title. These are not judgments. They are checks, each one a comparison between something you told Cipher and something the posting says, and they are computed in code with no model involved. A later section describes the general pattern, that what is a matter of checking is done by code and what is a matter of reading is done by a model. This is one of its instances.

Above those three parts sit two gates, and you set both of them. If you told Cipher there is something you will not accept in a role and the posting asks for it, the score is capped and the specific conflict is named to you. If you told Cipher there is something a role must have and the posting does not offer it, the score is capped and the gap is named. Both caps hold the score inside the lowest zone, and no strength elsewhere in the score lifts it out. These gates are enforced in code, not requested of a model. Cipher does not ask a model to remember a rule you set. It applies the rule.

And there is a state that is not a number. The score is built from what you have told Cipher you want, and where you have not told it yet, there is nothing to compare a role against. Cipher does not invent a middle-of-the-road figure in that case, and it does not ask a model to produce a placeholder. It tells you the score cannot be computed until you have said what you want, and it leaves the space empty until you have.

What Cipher does differently: every part of this score is a comparison against something you said. Cipher does not infer what you want from the language of your record, does not guess at it from the roles you have held, and does not score a role against a career it has decided you ought to have, and it holds itself to that wherever this score speaks to you. Where you have not said, it does not score.

The evidence, and what it does not reach

The first part of the score, whether the role fits what you said you want, is the part with a research base behind it, and it is worth being exact about what that base is and where it stops.

A 2005 meta-analysis in a peer-reviewed journal pooled the published and unpublished studies it could find on how well people fit their jobs, their organisations, their groups and their supervisors. For the fit between a person and their job, it found true-score correlations of .56 with job satisfaction across 47 effect sizes and 12,960 people, .47 with commitment to the organisation across 18 and 4,073, and −.46 with intending to quit across 16 and 3,849.1 Those are the relationships the first part of this score is built on: people who fit their jobs report liking them more and wanting to leave them less.

Three things travel with those figures, and Cipher will not quote them without these.

They are associations, not causes. Nothing in that literature assigned anyone to a job at random.

Two more things the evidence will not support, and Cipher does not claim them: it does not say you will perform well, and it does not say you will stay. In the 2005 analysis both relationships were weak, and the turnover one was weaker still.

What Cipher does differently: the first part of this score rests on a large, peer-reviewed, associational evidence base, and Cipher labels it as exactly that. Cipher does not present this score as a probability of being satisfied, does not tell you it predicts how you will perform or whether you will stay, and does not let a good fit with the job stand in for the fits it cannot see.

The part that rests on judgment

The second part of the score, whether a role moves you in the direction you said you want to go, has no study behind it, and this section says so rather than dressing it in one.

No study is cited for this part of the score, because none in Cipher’s evidence base measures the thing it would have to measure: whether a move that runs against the direction someone stated costs them anything. So this part rests on Cipher’s own reasoning, and the reasoning is short. You said which direction you want to go. A posting describes a level, a scope and a function. Whether the second matches the first is a question a careful friend could answer by reading both, and it is the question Cipher asks. It is labelled, where you read it, as a judgment and not as a measurement, and it carries less weight in the score than the part above it for that reason.

What Cipher does differently: where a part of a score rests on judgment, Cipher says so in the place you read it, and does not borrow a citation to make it look like more. The direction of your career is your call. Cipher’s job here is to make sure you noticed the question.

What to do with it

Read the gates first, the way you would for any score. A cap here is telling you that a posting conflicts with something you said, and the honest responses are the same two: decide the rule still holds, or decide with your eyes open that this role is the exception.

And read it as coming from your side of the table. This is the one score Cipher computes that an employer would have no reason to want. Its purpose is to make sure that the question of whether a job is right for you is asked out loud, by something that has no stake in your taking it.

What Cipher does differently: Cipher does not decide whether a role is right for you. It makes the case for and against, from what you said, and hands you the reasoning.

Section 5c: endnotes

Kristof-Brown, Zimmerman and Johnson (2005), Consequences of Individuals’ Fit at Work: A Meta-Analysis of Person–Job, Person–Organization, Person–Group, and Person–Supervisor Fit, Personnel Psychology 58(2), 281–342. Peer-reviewed meta-analysis.

Why three scores and never one

Three numbers is an awkward thing to hand someone. One would be simpler to read, easier to sort by and easier to sell. This section is about why Cipher will not produce it, and the reason is structural rather than a matter of taste.

What a single number would erase

Each of the three scores asks a different question. Filter probability asks whether the document carries the right words in a form that can be read. Shortlist strength asks whether your record answers what a role is hiring for, read the way a person would read it. Career alignment asks whether the role supplies what you said you want. Two of those are the employer’s questions and one is yours, and none of them is a version of another.

When the three agree, a blend would cost nothing. When they disagree, it would cost the only thing worth knowing.

Take a resume that scores low on filter probability and high on shortlist strength. That is a specific situation with a specific meaning: the record is strong and the posting’s literal screen is likely to miss it, often because the posting was written as though years in a role were the same thing as skill in it. The useful response is not to rewrite the resume. It is to find a way around the screen to a person. Now take the reverse, high on filter probability and low on shortlist strength. That is a document that carries the posting’s vocabulary without the substance a reader would look for behind it, and the useful response is to look hard at it before sending it. Average either pair and you get a middling number that looks identical to a middling resume, and both of those responses vanish.

Career alignment makes the point a third way. A role can clear both of the other scores and take you somewhere you said you did not want to go. Folded into one figure, that would read as a small deduction from an otherwise good score. Kept separate, it reads as what it is: a job you could get and might not want.

So the rule is that Cipher’s three scores are never combined into a composite, an average or a weighted blend, at any layer. Not in what is stored, not in what is sent to your screen, not in how a page is laid out, and not quietly inside an instruction to a model. They are three signals, read as a pattern. Where the pattern means something, that meaning is a sentence Cipher can say to you, never a fourth number.

What Cipher does differently: Cipher holds itself to three scores and no total, wherever it speaks to you. A tool that summed them would be throwing away the disagreements, and the disagreements are where the advice is.

What the research does not settle

Cipher does not rest this rule on research, and does not claim that research settles it. The evidence behind each score is set out in that score’s own section, and each section says what its evidence reaches and where it stops. None of it establishes that the three questions are independent of each other in any statistical sense, and the rule does not need them to be. Two questions can overlap in their evidence and still be different questions, and a person can need the answer to each one separately. That is the whole of what this section claims, and it is a claim about how Cipher is built, not about what the literature has found.

What Cipher does differently: Cipher keeps its scores apart because of what a blend would hide, and it says so without borrowing a study to say it for it.

What this section does not do

It does not re-argue any score. Each has its own section, and the evidence for each lives there.

It does not print a weight, a boundary, or a formula for reading the three together. There is none. Reading them together is a judgment, and this document has been consistent about whose judgment that is.

And it does not claim the three are unrelated. It claims that when they come apart, Cipher will let you see it.

What the scores don’t predict

Three numbers is a small thing to hand someone who is looking for work. This section is about what they are not, and about why each limit is a decision rather than an unfinished piece of engineering.

There are three of them, and they run in order of how far they reach.

The reading varies, not the record

The scores estimate what a record does at a screen. They do not estimate what a record is worth.

That distinction sounds like hedging. It is not. It is the thing the evidence keeps measuring, in designs that have almost nothing in common with each other.

Start with stated preference. A hiring experiment run in 2025 asked 1,725 professionals with direct hiring experience, recruited through Prolific, to choose between paired fictitious CVs across 22,195 comparisons. What predicted a recruiter’s choice was not only the CV. It was the recruiter. Their own use of generative AI moved the choice on a steady gradient, from a coefficient of 0.57 for those using it less than monthly to 1.20 for daily users, both at p < 0.1. Believing AI would be extremely impactful on their industry was the strongest recruiter trait in the full model, at 1.25, p < 0.1.1 That study is an unrefereed working paper, funded by the Microsoft AI Economy Institute and disclosed as such, and it is stated preference on invented CVs rather than a record of real hiring.

Now the same shape from a field experiment, where the applications were real and the employers did not know they were being studied. A correspondence audit sent 12,224 applications to 4,594 administrative support postings across four rounds between 2012 and 2014. Applicant age was never written anywhere. It was carried entirely by year of college completion and the length of the work history. In the fourth round, callback rates for the three age bands, youngest to oldest, were 34.6%, 32.6% and 16.3% at postings that called back one of the four applications, and 53.6%, 70.9% and 37.6% at postings that called back two. At postings that called back three, they were 73.7%, 76.3% and 75.0%. The age gap is gone. The odds ratios by number of callbacks run 0.373, 0.363, 0.965. The authors read this as employers with higher callback rates being less choosy, so resume characteristics matter less to them.² The figures cited here come from the NBER working paper version, which states on its own front matter that it has not been peer-reviewed, and the applicants were fictitious college-educated women aged 35 to 58.

The same resumes. Different postings. A penalty that is large at one and absent at another.

The cleanest version of the point comes from a study that measured the perception separately from the evaluation. A manuscript on high-potential designations ran an archival study inside one large engineering company and a pre-registered experiment with 1,366 participants who had managerial experience. In the archival data, gender had no correlation with rated passion at all, at r = .2, p = .59, and no interaction with performance or with departmental composition. In the experiment, the manipulation check confirmed the passionate video was rated more passionate than the control, 6.33 against 5.31, F(1,1364) = 370, p < .001, and that check did not interact with the employee’s gender.³ Viewers agreed on what they had seen.

Three constraints travel with all of that. The document is a pre-copyedit manuscript with no journal name, volume or pagination, and this corpus has not established its refereeing status. Its focal three-way interaction is not statistically significant in either study, at p = .57 and p = .078, so every headline is a decomposed contrast inside one performance cell, which the authors name as a limitation themselves. And no resume, application or screening decision appears anywhere in it. Both studies concern an incumbent employee being considered for internal advancement.

What Cipher does differently: no Cipher score is presented as a property of your document. A score is an estimate of how a record is likely to fare at a particular screen, and Cipher will not tell you what your material is worth in general, because the evidence says there is no such quantity. This is also why Cipher does not rank you against other candidates. There is no reader-independent scale to grade you on.

The channel, and no document changes it

The second limit is larger and it is the one job seekers are least often told.

A large share of what happens to an application is decided before the document is read, by how the application arrived. Administrative records from one US financial services firm, covering 62,127 applications to 315 postings resulting in 340 hires, show internet job board applicants making up 60.1% of applicants, 40.0% of interviewees, 23.6% of offer recipients and 23.5% of hires. Applicants referred by a current employee made up 6.1% of applicants, 21.4% of interviewees, 27.3% of offer recipients and 29.1% of hires. Six per cent of job board applicants received an interview, and 32.3% of those interviewed received an offer. Relative to job board applicants, referred applicants were 0.073 more likely to be interviewed, 0.024 more likely to receive an offer, and 0.139 more likely to receive an offer conditional on having been interviewed, all at p < 0.001.4 That is a working paper, and the authors state plainly that there is no exogenous variation in referral status in their data and that every figure is an association rather than a causal effect.

A peer-reviewed study of one bank’s phone centre found the same shape stage by stage. Of 4,165 external applications over two years, 60.1% were sent on for a hiring manager interview, 8.6% received an offer and 7.8% were hired. Referrals were interviewed at 64.8% against 57.5% for non-referrals, received offers conditional on interview at 18.3% against 11.6%, and received offers measured against all applicants at 11.9% against 6.7%, each at p < .0001. The advantage compounds, and it is larger after the interview than before it.⁵ That study covers one entry-level job at one firm, from applications filed in 1995 and 1996, in a local labour market where unemployment stayed below 4%.

The sharpest evidence comes from a peer-reviewed set of field experiments on an online labour market, and it is sharp because of one design choice. Every qualifying applicant was hired, so the study observed referred and non-referred applicants rather than only the people an employer had chosen. Four months after the first experiment, the researchers opened what looked like a different firm, with a different name, location, job posting and writing style, and hired from the same pool. The referred workers had not been referred to it and none of their referrers worked there. They still outperformed. Against a referred base submission rate of .763, non-referred workers ran .106 lower, at p < .05; on time submission .107 lower, p < .05; and reapplication, against a base of .815, .195 lower, at p < .1. Accuracy never differed at any specification. Then the load-bearing half: adding first and second order controls for every resume characteristic raised the share of variance explained to about a quarter for submission and about a third for reapplication, and left the referral coefficient essentially unmoved, moving from .106 to .100 to .114 on submission.⁶

The resume predicts performance. It does not contain what the referral contains.

The same paper is also the reason this section quotes no figure as the value of a referral to any individual. Its authors simulated an employer hiring the top-predicted half of the applicant pool. Observing resumes only, 58% of referred and 39% of non-referred applicants were hired, and the hired referred workers submitted 13 percentage points more often, p < .5. Observing resumes and referral status, 79% of referred and 9% of non-referred were hired, and the performance gap among the hired collapsed to 3 points, statistically indistinguishable from zero. The authors say the warning plainly: had they observed only the workers an employer chose to hire, they might have concluded that referrals contain little or no information about performance.⁶ The other three referral studies cited here all observe only the hired. That is why their magnitudes are reported above as what they are, differences in selection rates in particular firms, and are never converted into a number about what a referral would be worth to you.

What Cipher does differently: Cipher’s scores estimate what a record does at the screen it is submitted to. They do not estimate the probability of being hired, and no Cipher score is described as predicting a hire. Cipher does not sell a networking product, and it will not tell you what a referral would be worth to you, because the studies that measure referrals most carefully are the ones that say most clearly that no such portable number exists.

Cipher does take your network into account, and the evidence above is what sets the shape of it. A formal referral that has entered an employer’s process is credited, as a small modifier that can only raise an estimate and never lower one. A conversation with someone at the company, or a mention that never became a formal referral, is credited at nothing, because no study in this evidence base shows an unactivated contact changing what happens at a screen. That is not a penalty and you are never marked down for having made the call. And a connection cannot rescue a weak fit. The modifier is deliberately small, it sits on top of the factors that carry most of the score, and Cipher will not let who you know paper over a role that is wrong for you.

What Cipher can do is make the record you submit through whatever channel you have the best version of the truth about your work. That is a real thing to do. It is not the whole of the outcome and Cipher will not imply that it is.

Bias, and why the weight is zero

The third limit is the one that decides a design choice rather than only a claim.

The question is whether shortlist strength should adjust for demographics. Doing it would mean putting a number on your likely exposure to discrimination. Here is the evidence that would have to support that number.

A 2004 audit study sent 4,870 resumes to more than 1,300 help-wanted advertisements in Boston and Chicago between July 2001 and May 2002. Resumes with White-sounding names drew callbacks at 9.65% and identical resumes with African-American-sounding names at 6.45%, a gap of 3.20 percentage points, a ratio of 1.50, p = 0.0000.7 The same study found that a higher-quality resume raised callbacks for White-named applicants from 8.50% to 10.79%, a relative increase of 27%, p = 0.0557, and moved African-American-named applicants from 6.19% to 6.70%, p = 0.6084, not significant. Those two figures are one fact and are always written together. A better resume paid for one group and measurably did not for the other. The same table shows resume characteristics predicting callbacks less well for African-American names, with a standard deviation of predicted callback of 0.062 against 0.037, and a joint test that all resume characteristics have no effect returning 54.50 across all resumes, 57.59 for White names, and 23.85 for African-American names.⁷

A peer-reviewed meta-analysis of every available US field experiment of hiring discrimination with fieldwork through December 2015 pooled 24 studies and 30 estimates over 1989 to 2015, on 54,318 applications to 25,517 positions. Since 1989, whites received on average 36% more callbacks than equally qualified African Americans, with a 95% confidence interval of 25% to 47%, and 24% more than Latinos, interval 15% to 33%. It found no change in discrimination against African Americans across those 25 years, with time-trend coefficients near zero in every specification, and modest, marginally significant evidence of decline for Latinos at P = 0.099. Its authors state that the results pertain only to discrimination at the point of hire.⁸

These sources do not stack. Two audit studies twelve years apart in the same journal disagree on the level and agree on the differential return, and a meta-analysis of every US field experiment through 2015 finds the callback gap essentially flat across decades. A literature that cannot agree on its own direction is not a literature you can price into someone's score.

The screening software is no more stable. Three embedding models used for retrieval-based resume screening, tested across 554 resumes and 571 job descriptions in nine occupations, preferred White-associated names in 85.1% of 27 tests and Black-associated names in 8.6%, and preferred male-associated names in 51.9% and female-associated in 11.1%. Every case where a Black name won came from one of the three models, and every case where a female name won came from a different one.⁹ Comparing White male against Black male names, the White male name was preferred in 100% of 27 tests, with no test failing significance, while comparing White male against White female names produced a significant result in only 44.4% of tests.⁹

That is why no rate from this literature appears here as a rate. What can be said is that these systems produce disparities that are unpredictable and hard to control, which is close to what those authors say themselves.

There is one more result, and it is the one that matters most for anyone being told to run their resume through a chatbot. In a study of self-preferencing, three evaluator models were each shown a human-written summary and a version the same model had generated, describing the same candidate, with everything else in the resume held identical. Ground truth came from 18 blinded human annotators. Each model chose its own text over the human’s even in cases where the annotators had judged the human’s better on clarity, coherence or overall quality.¹⁰ In a simulated pipeline of 24 occupations and 30 runs, with ten resumes competing for four interview slots and content held constant by construction, so that an unbiased screener would pick two of each, the screening model was 23% to 60% more likely to pick a candidate for one of those four slots when that candidate’s summary was the model’s own writing. That is a relative increase in the screener’s own selections, not percentage points, and the confidence intervals excluded zero in all 24 categories.¹⁰

What Cipher does differently: shortlist strength carries demographic factors at a weight of zero, and names them as a disclosed caveat instead. Cipher will not put a number on your likely exposure to bias. The reason is not squeamishness and it is not an absence of evidence. It is that seven sources disagree with each other on magnitude, direction and mechanism, and the model-screening literature reverses on a change in how names were sampled. A weight requires a magnitude, and there is no magnitude here that would survive being applied to one person. Scoring it anyway would mean quietly deciding, on your behalf, how much discrimination to expect for you. Cipher would rather say the true thing, which is that this exists, that it is not a property of your record, and that no number Cipher could give you would be honest.

Section 7: endnotes

Farber, Silverman and von Wachter, Factors Determining Callbacks to Job Applications by the Unemployed: An Audit Study, National Bureau of Economic Research Working Paper 21689, October 2015. Working paper, not peer-reviewed. The comparison of six duration studies is drawn from the authors’ short companion paper, Determinants of Callbacks to Job Applications: An Audit Study, American Economic Review: Papers and Proceedings 106(5), 314–318; the refereeing status of that volume is not established here.

He, Jachimowicz and Moore, Passion Penalizes Women and Advantages (Unexceptional) Men in High-Potential Designations. Unpublished manuscript; the copy consulted carries no journal, volume or pagination and its refereeing status is not established here.

Fernandez, Castilla and Moore (2000), Social Capital at Work: Networks and Employment at a Phone Center, American Journal of Sociology 105(5), 1288–1356. Peer-reviewed journal article.

Pallais and Sands (2016), Why the Referential Treatment? Evidence from Field Experiments on Referrals, Journal of Political Economy 124(6), 1793–1828. Peer-reviewed journal article.

Bertrand and Mullainathan (2004), Are Emily and Greg More Employable than Lakisha and Jamal?, American Economic Review 94(4), 991–1013. Peer-reviewed journal article.

Quillian, Pager, Hexel and Midtbøen (2017), Meta-analysis of field experiments shows no change in racial discrimination in hiring over time, Proceedings of the National Academy of Sciences 114(41), 10870–10875. Peer-reviewed meta-analysis.

Wilson and Caliskan, Gender, Race, and Intersectional Bias in Resume Screening via Language Model Retrieval, arXiv 2407.20371v2. Preprint; no published version of record has been consulted here.

Xu, Li and Jiang, AI Self-preferencing in Algorithmic Hiring: Empirical Evidence and Insights, arXiv 2509.00462v4. Preprint; the version consulted here is the arXiv version.

Where AI is, where code is

The section before this one was about what a screen does to a record. This one is about what that evidence made Cipher build, and about what you are told on the days part of it cannot run.

Most of Cipher is not AI

Cipher is largely code, with AI in select functions.

AI is used where a job requires reading language and making a judgment about it: taking a job description apart into the separate things an employer says it needs, weighing whether something in your record answers one of them, drafting wording you then read and confirm. Everything else is ordinary software, written once, doing the same thing on Tuesday that it did on Monday.

The scores are the clearest illustration. Each one is assembled from a set of factors. A model judges the factors that turn on reading language, because deciding whether a line of your record speaks to a stated requirement is a language question and nothing else does it well. Factors that are a matter of checking rather than reading are computed in code instead, without a model involved at all. Code then does everything after that: the weights, the arithmetic, the gates and the boundaries between the zones. What each score estimates and which factors it is built from are described in their own sections. What matters here is where the machinery sits. Weights that live in code cannot drift, cannot be quietly forgotten, and cannot come out differently because a model answered differently today.

What Cipher does differently: the default is code, and AI has to earn its place by being the only thing that can do the job. That is not a limit Cipher ran into. It is a limit Cipher chose, and the next two parts of this section are the reason.

An instruction is not a control

The most common way an AI product claims to be careful is to say that it tells its models to be careful. Three studies tested exactly that, aimed squarely at the mechanism, and it is worth knowing what they found before trusting anyone’s version of that sentence.

The first is a 2026 preprint that ran six models over a resume-rating task and tried two fixes: instructing the model to give its reasoning, and instructing it to uphold diversity, equity and inclusion. The authors’ conclusion is that neither is sufficient, neither consistently outperforms the other, neither eliminates bias, and neither consistently produces less bias than the baseline prompt. The instructions did move something, just not the thing they were aimed at. Hiring likelihood fell by 15% for gendered names and 26% for pronouns when reasoning was requested, and by 40% and 34% when reasoning was added to the diversity instruction. An instruction meant to be neutral as to outcome shifted how often the model hired at all by up to 40% and left the disparity standing.¹ That paper is a preprint and not peer-reviewed, every one of its six models was superseded before it appeared, and its authors state in an ethical statement that they do not endorse or recommend the use of large language models for hiring decisions or resume evaluation in real-world settings.

The second went further than an instruction. It is the peer-reviewed study behind the disability findings in the previous section, and its authors built a custom model configured to avoid ableist bias, to incorporate disability-justice principles and to hold to diversity, equity and inclusion values. That configured model ranked the stronger CV first in 37 of 60 trials, against the unmodified model’s 15. The improvement reached significance in two of the six conditions and did not improve on the unmodified model at all in the condition covering depression, and the authors are explicit about what that means: a model configured this way does not adequately address the bias, deploying one without addressing the more stigmatised conditions would deepen marginalisation, bias has to be examined condition by condition rather than as an average, and they ask readers not to report the successes without reporting where the approach failed.² That work ran on a consumer web interface to a model of Winter 2023 vintage.

The third tested an instruction pointed precisely at its own mechanism. In a study of models preferring machine-written text over human-written text, the evaluator models were told not to consider or infer whether a resume had been written by a person or by a machine. In one model, the preference for its own text fell from 82% to 61%. Pooling the votes of additional models did better. The best result across every mitigation tested still left 23%.³ That work was written in August 2025 and its models are of that period.

None of the models in those three studies is in Cipher. That is the point of saying when each was run, and it is also why none of these numbers is a claim about what any model does today. What survives the vintage is not a rate. It is the finding those three designs share, which is that an instruction aimed at a model’s behaviour changes the behaviour without controlling it.

What Cipher does differently: Cipher does not describe any instruction given to a model as a safeguard. Where a property has to hold, it is enforced in code, or Cipher does not claim it. A line in a prompt asking a model to be fair is a request, and the evidence is that a request moves the answer around without fixing what it was aimed at.

A model’s comparison of two documents is not a measurement

The same peer-reviewed study ran a control before it measured anything, and the control is worth more than it looks. It handed the model two identical copies of one CV and asked which was better. The model called it a tie in 70% of trials and ranked one copy above the other in the remaining 30%, sometimes explaining the choice in terms that contradicted the ranking inside the same answer.² Same tool, same Winter 2023 vintage.

The self-preferencing study supplies the other half. Its ground truth came from 18 human annotators working blind to where each summary had come from. Every evaluator model chose its own text over the human’s, including in cases where those annotators had judged the human’s better on clarity, coherence or overall quality.³

Put plainly: asking a model which of two documents is stronger produces an answer, and the answer is not a measurement of the documents.

What Cipher does differently: no Cipher score is a model’s opinion of you. Cipher does not ask a model whether your resume is good, and it does not ask a model to place you above or below anyone else. A model is asked narrow questions about language, one factor at a time, and code turns those answers into a number by a rule that was written down in advance. This is also the reason “run it through a chatbot and ask which version is better” is not a method, however confident the answer sounds.

When the AI cannot run

Cipher runs on more than one AI provider, so a single vendor’s outage does not take the product down. When one is unreachable, Cipher retries and moves to another.

The rule underneath that is stricter than it sounds. A task either has a second provider standing behind it, or it is written down as a named exception with a stated consequence for what happens when its provider is gone. There is no third state, and silence does not count as coverage.

When every provider has been tried and none can be reached, Cipher says so. It names what that means for the thing you were in the middle of, and it never behaves as though the step ran. “Something went wrong” does not meet that standard, because it leaves you guessing what you now hold. You are not left believing a check happened when it did not.

What that notice says is worked out surface by surface rather than once for the whole product, because the honest answer differs by what was interrupted. Where a step reads your record against a job’s stated needs and cannot run, the fallback has to be a path that already exists and not a theoretical one, so you can go through your full record yourself. And where a guarantee is the kind of thing the product’s credibility rests on, it is put somewhere that cannot go down. Spelling and mechanics are ordinary code and always run. The read for whether the writing actually hangs together is AI, and when it cannot run, it is skipped and you are told it was skipped rather than being handed a document that looks finished.

The honest half of that is a task that deliberately has no second provider, chosen that way on measurement. When its provider is exhausted, the score does not come back half-computed and presented as a result. It defers, and the surface says so.

There is a standard behind all of this that is worth stating outright, because it governs this document too. What Cipher tells you may assert only what Cipher can actually establish at the moment it says it. Where the proof cannot be constructed, the claim comes out. It does not get softened into something vaguer that would survive.

What Cipher does differently: Cipher would rather tell you that a step did not run than show you a number produced without it. A tool that degrades invisibly is worse than one that is briefly unavailable, because the damage is done at the moment you find out, and by then you have already relied on it.

Section 8: endnotes

Gerszberg, Hamori and Lo (2026), Quantifying Gender Bias in Large Language Models: When ChatGPT Becomes a Hiring Manager, arXiv 2604.00011v1. Preprint, not peer-reviewed.

Xu, Li and Jiang, AI Self-preferencing in Algorithmic Hiring: Empirical Evidence and Insights, arXiv 2509.00462v4. Preprint; the version consulted here is the arXiv version.

What Cipher costs

The section before this one was about where the machinery sits and what you are told when part of it cannot run. This one is about what you are paying for: what is counted, what is never counted, what you rent and what you buy, and what happens to each of those when you stop.

One thing is deliberately missing from it. No price appears in this section, and no count. Not the monthly price, not the size of an allowance, not how long a grant lasts. Those numbers live on the pricing page and in the order you placed, and they may change on notice there. A number written here would be a second copy of a value that has one home, and it would be wrong the first time that home moved. This is the same rule the section on composition used for the size of a needs list, and the score sections used for their caps. It is a rule about where numbers live, not a reluctance to say them.

Two ways in

Cipher has a free trial and a membership.

The free trial asks for no card. Nothing is charged, nothing is held on file, and the trial does not turn into a membership by itself: no charge is ever made without you choosing to make it. The trial has its own allowances, and they do not renew. When they are spent, they are spent, and what is offered at that point is membership.

Membership is a subscription with a recurring allowance. It renews until you stop it, and you can stop it yourself, from your account, in no more steps than it took to subscribe. Your card details go to Cipher’s payments provider and not to Cipher; Cipher never holds them.

Two things are counted, and only two

Everything Cipher meters comes down to two units, and it is worth being exact about what each one is, because a member who does not know which action costs them cannot manage what they spend.

An assessment is a career alignment score. Running career alignment on a job description spends one assessment. Nothing else does. Pasting a posting in, having Cipher take it apart into its separate needs, and reading and approving that list cost you nothing on any counter, however many postings you look at. Only the moment Cipher tells you whether this job supplies what you want spends the unit. That is deliberate. The question of whether you should even apply is the most useful thing Cipher asks, and charging you for looking at a posting would tax the asking of it. The same thing is counted on the trial and on membership. The two differ in the size of the allowance and in whether it renews, and in nothing about what is being counted.

An assessment is spent when the work is done, not when you act on the result. A run that fails or comes back degraded spends nothing. A run that completes and that you then walk away from has spent one, because the work was performed. Coming back to the same posting, unchanged, spends nothing more: you are given the result you already paid for.

A resume is a generated resume. The unit is spent at the point where you choose to generate, after you have seen the career alignment score for that job and after you have been shown what you have left, as the section on confirmation described. Your choice to proceed is what spends it. A second generated resume for the same job spends a second unit; there is no free regeneration. A build that fails or cannot be completed spends nothing, and you are told so in the same place you are told it failed. And, as that earlier section already said once, a refusal is never charged for, on any meter.

What is never counted

Downloads are never counted, on any tier. Any format, any version you have generated, as many times as you like.

Filter probability and shortlist strength are never counted. They are offered once the resume exists, one of each, and run when you ask for them. They are not an allowance, they do not run down, and declining them does not bank them for later.

Editing a resume, revising it, and working inside your record are not counted. What is counted is the generated resume, and the paragraph above says when that happens.

The trial and membership differ in their counts, and in one thing that is not a count: the cover letter advisor is part of membership and not of the trial, where what you see is an example rather than analysis of your own record. Cipher holds itself to that being the only difference of kind between the two. Everything else that differs between them is a count. Every member who runs a score can open all of it, on every tier, as the score sections said.

What you rent and what you buy

The distinction that matters most to your money is this one. An allowance is rented. A packet is bought.

Your membership allowance is released by the charge that pays for it. A monthly charge releases that month's allowance; a six-month charge releases the whole term's allowance at once, on the day you buy it. A charge that does not pay for a full term (a mid-term plan change, or a charge of nothing) releases no allowance, and nothing carries from one term into the next. Each grant carries its own last day. Cipher shows you each grant you hold, how many remain in it, and the last day it works, on the surfaces where you would spend it, so that you never learn about an expiry from the fact of having missed it. Cipher also writes to you shortly before a grant lapses. When you spend, the grant nearest its expiry is spent first, and every grant is spent before any packet is touched, so that nothing you are holding lapses while something more durable is consumed in its place.

A packet is different. A packet holds resumes, and you buy it outright. Packet resumes never expire, no cadence touches them, and they survive a pause of any length and are there in full when you come back. Assessments are not sold in packets, or anywhere else: a packet buys resumes and nothing else, on every tier.

When you have spent your assessments and still hold resumes, you can still build. Cipher takes you from the approved list of needs straight to the build station, without a career alignment score for that job, tells you the date your next assessments arrive, and sells you nothing there, because there is nothing true it could sell you. When you have spent your resumes, membership can buy a packet at the point where the unit would have been spent, and the purchase does not cost you your place: you come back to the gate you left with your work intact. The trial cannot buy a packet. What it is offered is membership, and whatever remained of the trial’s allowances does not carry across into it. Membership starts with its own.

What stopping does to your money

There are three ways out of a membership, and the section that follows is about what each does to your data. Here is what each does to money and allowance.

Pause. A pause takes effect at the end of the period you have already paid for, never in the middle of it. You keep full membership through that date, you are not charged again, and the period you are in is not refunded. From then on billing stops. No new grants arrive while you are paused, the grants you already hold keep expiring on their own schedule, and a grant that lapses during a pause does not come back when you return. Packets are untouched by any of that. Against packets you already hold, a paused member still composes a resume, receives all three fit scores, and downloads it. A pause suspends what you put in, not what Cipher gives back on something you have already paid for.

Activate. Billing resumes, and so does the allowance, from the day you return. Nothing accrues for the time you were paused.

Delete. Deleting your account ends the recurring charge as well, because Cipher cancels the subscription as part of deleting. It is never the way to stop paying, and it is not presented as one: stopping the charge is what pause is for, and it is reachable in the same place. What deleting does to everything else is the next section.

What happens to your data

The section before this one was about what you pay for. This one is about what Cipher holds of yours, what it does with it, what leaves Cipher’s hands to be processed, and what happens to all of it when you leave.

There is a rule underneath this section, and it is stated first because everything else follows from it. Cipher’s Privacy Policy and Terms of Service are commitments. They are not descriptions of features, and they do not get the treatment features get elsewhere in this document, where a rule is written flat because a ruling stands behind it. They are what Cipher is bound by. This section says nothing wider than the Policy says, and where a sentence here could be read wider than the Policy, the Policy is what holds.

Pause, activate, delete

The three ways out of a membership were listed in the last section for what they do to money. Here is what they do to what you built.

Pause keeps everything. Your Career Record, your master resume, and your library of generated resumes stay yours to open and to download at any time, for as long as you are paused. Nothing you made is altered, hidden, or removed.

Activate returns you to everything exactly as you left it.

Delete destroys the account and every record in it, permanently and immediately, with no undo. There is no waiting period and no way back. Cipher does not soften that at the moment you do it: the confirmation says what is about to happen, in those terms.

The name of that action is a deliberate choice, and the reasoning is worth having. In every subscription product you have used, “cancel” means the billing stops. It is the word people reach for when they want to stop paying. Cipher never attaches the destruction of your data to that word alone. The action that deletes is named for what it does, and stopping the charge is a separate action, in the same place, under a different name. A member who wanted to stop paying must never delete their career by mistake, so Cipher keeps the two apart. Deleting is not required to stop billing, and it never will be.

What deletion removes, and what it does not

“Everything is deleted” is an easy sentence to write and a hard one to stand behind, because it quietly claims that every place your data could sit has been checked. So this section does not write it. It states what Cipher commits to, in the Policy’s own scope, and then it names what the Policy says survives, including the parts that are awkward to say.

When you delete your account, Cipher permanently deletes your account, your data, and your uploaded files from its active database and its file storage, right away. That is the commitment. It is immediate and it cannot be undone.

What the Policy says about the rest:

Database backups. Cipher keeps rolling daily backups of its database for seven days. No backup containing your data survives more than seven days after deletion. Your uploaded files are not in those backups at all.

Analytics and email tools. Cipher removes your personal data from the analytics and email tools it uses. Today that is done by hand, as part of handling your request, within the response window the Policy states.

Error monitoring. The tool Cipher uses to monitor errors does not support deleting an individual person’s records on request. Cipher limits what is sent to it and removes what it can, and whatever diagnostic data remains expires on that provider’s own retention schedule, which the Policy states.

Emails already sent to you may remain with the email provider for that provider’s own retention period, which the Policy states.

Contact-form messages. If you have written to Cipher through the contact form, that message and the contact details you sent with it are kept as a record of the correspondence, and deleting your account does not remove it.

Financial records. Payment and billing history is kept for as long as the law and the payment processor’s obligations require, which can be years after the account is gone.

Residual data may persist briefly in third-party operational systems, on their own schedules and within their own technical limits.

That list is the Policy’s, and this document neither adds to it nor takes from it. None of it limits the rights you hold under the law where you live, and the Policy sets out how to exercise them and how to appeal.

Cipher learns from two categories of data, and only with your consent.

The first is outcome data: what you tell Cipher happened to an application, such as whether a resume led to an interview. The second is product-usage patterns: how members interact with the product, such as how they choose evidence from their records or the order in which they work through building a resume. Cipher studies usage patterns to understand how the product is used and to inform future features.

The consent is a setting in your account. It is off unless you turn it on, and you can turn it on or off at any time. Turning it on or off does not change your own outcome tracking, which is yours regardless, and it does not change any resume you have built.

What Cipher does with that data is bound by the Policy, and the commitments are these. It is used only in de-identified, aggregate form, never as your individual records. Cipher builds those patterns only from the records of members who are opted in at the time it builds them, and rebuilds them rather than adding to them, so turning the setting off, deleting an outcome, or closing your account removes your contribution from the next rebuild. Cipher draws no conclusion from any group smaller than fifty people, so that no pattern can point at a person. Cipher does not attempt to re-identify it, requires the same or stronger commitments from anyone it shares it with, never sells it, and never ties it back to your profile when it uses it outside Cipher, whether in published research or in marketing.

Where your content goes to be processed, and what it is never used for

When you use a part of Cipher that runs on AI, the relevant content is sent to a third-party AI provider to produce your result: resume text, entries from your Career Record, the job description you pasted. It is processed in real time to produce your own output. Cipher uses more than one provider, as an earlier section described, and if one is unavailable your content may be processed by another.

Cipher does not filter sensitive information out of what you upload or type before it is processed. If your record contains health, disability, immigration, or similar details, those go to the provider with the rest. Do not put into Cipher what you do not want processed unless you need it there for the work Cipher does for you.

Here is the sentence that every AI product’s data policy is judged on, and it is written to be true under both of Cipher’s legal documents and not only under the narrower one. Cipher does not use your personal data, including your Career Record, to train large language models, whether Cipher’s own or any third party’s. Cipher’s improvement comes from the de-identified, aggregate patterns the previous part described, under the consent it described.

Two more commitments belong here, because a resume tool is exactly the kind of product where a member would wonder. Cipher does not sell personal data, sensitive or otherwise, and does not today use it for targeted advertising; the Policy says what Cipher would have to do first if that ever changed. And your fit scores are tools for your own use: Cipher does not use them to make decisions about you, and does not share them with employers or anyone else.

Claims Cipher will not make

It is a list of four. Two of the four are argued in full elsewhere in this document, and they are not argued again here: the refusal is stated, and you are pointed to where the evidence already sits. The other two are this section’s own, and this is the only place in the document you will read them. They come first, because they are the two most likely to touch you directly.

Cipher does not say “impostor syndrome”

You may have been told, by a book, a manager, a workshop or a friend who meant well, that you have impostor syndrome. If building your Career Record ever leaves you feeling that the account of your work is thinner than the work, the label will be near to hand. Cipher will not use it, and the reason is worth a minute of your time, because it is a kindness rather than a rule.

The label sounds like a diagnosis. It is not one. A peer-reviewed systematic review published in 2020 gathered 62 studies of the phenomenon, 66 articles covering 14,161 people, and three things from it matter here. The first is how common it is supposed to be. Reported prevalence across those studies ran from 9% to 82%, and the review attributes that spread largely to which screening questionnaire was used and where its cutoff was set. Inside one of the included studies, moving the cutoff on the same questionnaire moved the prevalence from 24% to 39% of the same people.¹ The second is whether it is a recognised condition. It is not a recognised condition, and the review's own recommendation that it be considered for inclusion is another way of saying so. The third is what treats it. None of the included articles evaluated any treatment. The only clinical account in the set is a description of 41 patients from 1985, with no data on treatment or on whether anyone improved.¹

Two things about that review travel with it. It was funded by a company, Crossover Health, and all of its authors but one were employees of or consultants to that funder; the paper discloses this. And the evidence it reviewed was nearly all single cross-sectional surveys, often of convenience samples, with no randomised trial among them. The people surveyed had a weighted mean age of 20, and 34 of the 62 studies were of students. The review also notes that the questionnaires were standardised on samples with few non-White participants, which in its own words may invalidate them for exactly the populations the label is most often applied to.¹

So here is what the label is: a figure for how many people have it that runs from 9% to 82% depending on who is asking and how, no place in either diagnostic manual, and no treatment anyone has tested. A person who is handed it is being handed a name for a feeling, and nothing else comes with the name. Cipher will not hand it to you.

What Cipher has instead is narrower and better. The section on the Career Record set out a working paper that measured, in a bounded and specific way, how equally performing people describe their own performance to an employer, and found that the description and the performance come apart even when people have been told exactly how they did.² That is a finding about one task. It is not a finding about you as a person, and it does not need to be. It is why the Career Record asks what happened rather than how good you were, and it is the whole of what Cipher takes from this area. The finding is used. The label is not.

What Cipher does differently: Cipher never tells you what you have. It asks you what you did. If the account comes out smaller than the work, that is a thing the record is built to fix, and it is not a thing that is wrong with you.

Cipher does not remove who you are from your resume

There is a piece of advice that circulates whenever screening bias comes up, and it sounds like good sense: take the identifying details off. Your name, perhaps your neighbourhood, the university, anything a reader or a system might use to guess who you are. A product could offer to do that for you.

Cipher will not, and the reason is not caution. It is that it does not work, by the account of the people who measured the problem it is meant to solve. The preprint on retrieval-based screening that the section on what the scores do not predict set out, whose models in their headline result preferred White-associated and male-associated names, raises the idea of stripping names from resumes and rejects it. The authors call it naive. Real resumes differ from each other in many other ways that signal group membership: the institutions attended, the places lived and worked, and the choice of words on the page. Their own conclusion is that the disparities their models produced are unpredictable and difficult to control in a real-world screening setting, and that what is needed is auditing of the systems that screen.³ That study tested embedding models of 2024 vintage against resumes and job descriptions, with no employer and no hiring decision anywhere in it, as the earlier sections said.

So a product that offered to anonymise you would be selling you a protection it cannot deliver, while asking you to take true things about yourself off your own record in order to receive it. Cipher does not strip identity-linked content on your behalf. What goes into your Career Record is yours to decide, everything on a Cipher resume comes from that record, and what you choose to leave out of it is a decision this document has been careful to leave with you. Cipher does not make that decision for you, and it does not pretend that making it would change what a screen does.

What Cipher does differently: Cipher will not sell you invisibility. It will help you say, accurately and specifically, what you have done, which is the one thing about your record that every study in this document agrees is worth getting right.

Cipher puts no rate on model bias

Cipher puts no rate on model bias. The section on what the scores do not predict set out why: the model-screening studies that carry the striking figures reversed direction when the names were sampled a different way, and a number that flips with the sampling is not a number Cipher can put beside your name. The argument is that section’s, and it is not run again here.

Cipher does not call an instruction to a model a safeguard

Cipher does not describe any instruction given to a model as a safeguard. The section on where AI is and where code is set out three studies in which a line in a prompt asking a model to be fair moved its answers without fixing what the line was aimed at, and that is why anything Cipher needs to hold is enforced in code or is not claimed. The argument is that section’s, and it is not run again here.

What the rest of this document has already refused

Those four are the refusals that stand on evidence this document sets out here or points at directly. They are not the whole of what Cipher declines to say. The earlier sections carry the rest, each beside the evidence for it, and for a reader who wants them in one place, here they are, a sentence each, with the argument left where it lives.

Cipher does not print a rejection rate, anywhere it speaks to you. That refusal, and its reason, open the section on what actually filters people out.

Cipher does not claim to know how any particular employer’s software is configured, and does not sell you a way through it. That is the filter probability section’s.

Cipher does not guarantee interviews, jobs or specific outcomes, and will not promise you a percentage more interviews for a better-written document. The section on composition and length and the filter probability section each say so.

Cipher does not write your resume for you, and does not test your record for machine writing. Both are the shortlist strength section’s.

Cipher does not present career alignment as a probability of being satisfied, and does not tell you it predicts how you will perform or whether you will stay. That is the career alignment section’s.

Cipher does not combine its three scores into one, at any layer. That is the section on why three scores and never one.

No Cipher score is presented as a property of your document, none predicts being hired, none ranks you against other candidates, and none puts a number on what a referral would be worth to you. All four are the section on what the scores do not predict.

Cipher does not behave as though a step ran when it did not. That is the section on where AI is and where code is.

Section 11: endnotes

Bravata, Watts, Keefer, Madhusudhan, Taylor, Clark, Nelson, Cokley and Hagg (2020), Prevalence, Predictors, and Treatment of Impostor Syndrome: a Systematic Review, Journal of General Internal Medicine 35(4), 1252–1275. Peer-reviewed systematic review; funded by Crossover Health, which employed or engaged as consultants all of the authors but one, as the paper discloses.

Exley and Kessler (2019, revised May 2021), The Gender Gap in Self-Promotion, National Bureau of Economic Research Working Paper 26345. Working paper, not peer-reviewed.

Wilson and Caliskan, Gender, Race, and Intersectional Bias in Resume Screening via Language Model Retrieval, arXiv 2407.20371v2. Preprint; no published version of record has been consulted here.

Sources, and how each is labelled

This document cites 26 sources. Every figure taken from one carries the qualifiers the paper attached to it. This section is about the labels: what kind of thing each source is, which version of it was read, which of them are not as independent of each other as a count would suggest, and what applying one rule to all of them turned up.

The rule is that every source is labelled in the sentence that uses it, by type, at the point you read it. Not in a footnote you have to go and find, and not once in a list at the back. Where a sentence rests on a vendor’s poll, the sentence says so. Where a section’s evidence is mostly unrefereed, the section says so in its own text rather than in a note. That has been the practice throughout, and the endnotes under each section repeat the label so that no citation can be lifted out of this document without it. What follows states the rule in full and is then honest about what it revealed.

What the labels mean

Peer-reviewed journal article. A published version of record with a journal name, volume, issue and pages, read in that form. Where the document says a study is peer-reviewed, that is what it means and nothing more: the work passed a journal’s review, which is a floor and not a guarantee.

Peer-reviewed meta-analysis. The same, for a study that pools other studies. It is labelled separately because a meta-analysis inherits every limit of the studies it pools, and because two meta-analyses can rest on the same underlying data, which is exactly what happened here.

Peer-reviewed conference proceedings. Refereed on a conference’s schedule rather than a journal’s, and published with pagination.

Working paper, not peer-reviewed. A paper circulated for discussion by a research network, an institute, a central bank or a preprint server. In every case here the paper’s own front matter says it has not been peer-reviewed, and the label copies that. It is not a judgment on the work. It is a statement of what has and has not been done to it.

Unpublished manuscript. A copy carrying no journal name, volume, pages, identifier or date. The document says so wherever it cites one.

Employer survey with disclosed methodology, not peer-reviewed. A survey whose sample, dates and instrument are stated, published outside the refereed literature, by authors with an interest the label names.

Vendor poll, not peer-reviewed. A poll published by a company that sells to the people it polled. The entry names the panel, the screening and the field date where the source gives them, and says where the source does not.

Vendor-published study and vendor marketing document. A qualitative study or a brochure from the same kind of publisher, labelled for what it is.

Three reading rules sit under the labels. Nothing is cited that was not read whole. The version that was read is the version that is cited, and where that is not the version of record the document says so and cites no page from any version it has not seen. And no figure in this document comes from one paper’s citation of another: where a study quotes someone else’s number, that number is not used here unless the paper it came from was itself read.

Every source in this document, by label

Peer-reviewed journal articles, read as the version of record.

Bertrand and Mullainathan (2004), Are Emily and Greg More Employable than Lakisha and Jamal?, American Economic Review 94(4), 991–1013. Cited in Section 2, Section 5a and Section 7. The published article, with the table numbering this document cites.

Fernandez, Castilla and Moore (2000), Social Capital at Work: Networks and Employment at a Phone Center, American Journal of Sociology 105(5), 1288–1356. Cited in Section 2 and Section 7.

Kessler, Low and Sullivan (2019), Incentivized Resume Rating: Eliciting Employer Preferences without Deception, American Economic Review 109(11), 3713–3744. Cited in Section 2 and Section 5a.

Pallais and Sands (2016), Why the Referential Treatment? Evidence from Field Experiments on Referrals, Journal of Political Economy 124(6), 1793–1828. Cited in Section 3 and Section 7. The authors thank John Horton and the platform on which the experiments ran for help running them; Horton is an author of Wiles and colleagues, below.

Wiles, Munyikwa and Horton (2025), Algorithmic writing assistance on jobseekers’ resumes increases hires, Management Science 71(12), 10144–10164. Cited in Section 3, Section 4b and Section 5b. The only causally identified study of resume writing help in this document. Two of its authors received funding from the platform on which the experiment ran, and the paper discloses it. Horton, see Pallais and Sands.

Wingate, Robie, Powell and Bourdage (2025), The Signals That Matter: Resumes, Cover Letters, and Success on the Job Search, International Journal of Selection and Assessment 33(3), e70022. Cited in Section 3, Section 4c, Section 5a and Section 5b. The authors declare no conflicts of interest. Bourdage, see Bourdage, Roulin and Tarraf.

Peer-reviewed meta-analyses.

Peer-reviewed systematic review.

Bravata, Watts, Keefer, Madhusudhan, Taylor, Clark, Nelson, Cokley and Hagg (2020), Prevalence, Predictors, and Treatment of Impostor Syndrome: a Systematic Review, Journal of General Internal Medicine 35(4), 1252–1275. Cited in Section 11. Funded by Crossover Health, which employed or engaged as consultants all of the authors but one, as the paper discloses.

Peer-reviewed conference proceedings.

Glazko, Mohammed, Kosa, Potluri and Mankoff (2024), Identifying and Improving Disability Bias in GPT-Based Resume Screening, FAccT ’24, Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency, 687–700. Cited in Section 8. The model tested was a consumer web interface of Winter 2023 vintage. Funding disclosed in the paper: a National Science Foundation grant, Microsoft and a university research centre, with one author holding an Apple fellowship.

Working papers and preprints, not peer-reviewed.

Exley and Kessler (2019, revised May 2021), The Gender Gap in Self-Promotion, National Bureau of Economic Research Working Paper 26345. Cited in Section 3 and Section 11. The copy read is the working paper, whose own front matter says it has not been peer-reviewed. Whether a journal version now exists was not established from it, and nothing is cited from any.

Farber, Silverman and von Wachter, Factors Determining Callbacks to Job Applications by the Unemployed: An Audit Study, National Bureau of Economic Research Working Paper 21689, October 2015, together with the authors’ short companion, Determinants of Callbacks to Job Applications: An Audit Study, American Economic Review: Papers and Proceedings 106(5), 314–318 (2016). Cited in Section 2 and Section 7. Two documents of one study. The working paper’s tables are cited by default, and the companion supplies only the authors’ side-by-side comparison of six studies of unemployment duration, their own among them. The two documents do not report every figure identically, which is why the document names which one it used. On the companion’s volume, see below.

Stephany, Teutloff and Leone (2026), AI Skills Improve Job Prospects: Causal Evidence from a Hiring Experiment, arXiv 2601.13286, March 2026 version. Cited in Section 4b, Section 5a and Section 7. Funded by the Microsoft AI Economy Institute, disclosed in the paper. An earlier version of this paper states a different sample; the March version is the one read and the one cited.

Brown, Setren and Topa (2013), Do Informal Referrals Lead to Better Matches? Evidence from a Firm’s Employee Referral System, Federal Reserve Bank of New York Staff Report No. 568, August 2012, revised June 2013. Cited in Section 7. The series’ standing note says the paper presents preliminary findings distributed to elicit comment. The authors state that the paper makes no causal claim.

Wilson and Caliskan, Gender, Race, and Intersectional Bias in Resume Screening via Language Model Retrieval, arXiv 2407.20371v2. Cited in Section 5a, Section 7 and Section 11. The copy read carries a conference copyright line, which indicates a submission, and no published version has been consulted. Funded by a United States National Institute of Standards and Technology grant, disclosed in the paper. Shares its resume corpus with Xu, Li and Jiang, below.

Gerszberg, Hamori and Lo (2026), Quantifying Gender Bias in Large Language Models: When ChatGPT Becomes a Hiring Manager, arXiv 2604.00011v1. Cited in Section 8. The paper states it is based on a 2024 master’s thesis; its models are of 2023 to 2024 vintage.

Xu, Li and Jiang, AI Self-preferencing in Algorithmic Hiring: Empirical Evidence and Insights, arXiv 2509.00462v4. Cited in Section 7 and Section 8. A conference version of this paper was published in 2025; the copy this document was written from is the arXiv version, every figure here is from that version, and it is cited as such. Shares its resume corpus with Wilson and Caliskan, above.

Unpublished manuscript.

He, Jachimowicz and Moore, Passion Penalizes Women and Advantages (Unexceptional) Men in High-Potential Designations. Cited in Section 7. The copy read carries no journal name, volume, issue, pages, identifier or date, is visibly pre-copyedit, and its refereeing status is not established here. The sentence citing it says so, and says that no resume, application or screening decision appears in it.

Employer survey with disclosed methodology, not peer-reviewed.

Fuller, Raman, Sage-Gavin and Hines (2021), Hidden Workers: Untapped Talent, Harvard Business School Project on Managing the Future of Work, with Accenture. Cited in Section 2. Employer survey, 2,275 executives in three countries, fielded January to February 2020, co-authored with a consultancy that sells talent services.

Vendor polls and vendor-published material, not peer-reviewed.

Resume Genius (2026), 2026 Hiring Insights Report: ATS, AI, and Employer Expectations. Cited in Section 2, Section 4c, Section 5a and Section 5b. Published by a resume-builder company. Names its panel and its screening: n = 1,000 US hiring managers, Pollfish Random Device Engagement, screened for direct responsibility for hiring. No field date is given; March 2026 is the publication date.

ResumeBuilder.com (2023), 82% of Hiring Managers Unable to Identify Cover Letters Written by ChatGPT. Cited in Section 5b. Published by a resume-builder company. Names its panel, its field date and its screening: n = 1,000 US, Pollfish, fielded 22 to 26 March 2023, with a primary screen keeping frequent reviewers of application materials and a secondary screen keeping only those who believed they had already reviewed material written by ChatGPT.

Resume.io (2025), Study: 49% of hiring managers reject AI-generated resumes. Cited in Section 5b. Published by a resume-builder company. Names its field date and its weighting: an online panel of 3,000 managers fielded August 2024, stratified by age, gender and geography with post-stratification weighting. The date on the page, January 2025, is the publication date. The source states its headline figure two incompatible ways, as a share of managers and as a share of resumes; this document uses the manager-level reading, which is the one its map measures.

Robert Half (2026), Robert Half survey: 67% of HR leaders report AI-generated applications are slowing hiring, press release, March 10 2026. Cited in Section 5b. A vendor poll inside a press release published by a staffing firm. The release says the survey was conducted by an unnamed independent research firm in November 2025 with more than 2,000 US hiring managers, and names no sampling frame, no panel, no margin of error, no questionnaire and no screening criteria. Its prescribed remedy for the problem it describes is to hire a staffing firm, and the publisher is one.

Enhancv (2025/2026), Does the ATS Reject Your Resume? 25 Recruiters Explain What Really Happens. Cited in Section 2, Section 4c and Section 5a. Vendor-published qualitative interview study, n = 25, by a company that sells a resume builder. The authors state that the sample is intentionally small and the findings are themes, not statistics.

Four pairs that are not two sources each

A reader who counts sources is entitled to assume that two citations are two independent pieces of evidence. Four times in this document that assumption would be wrong, and this is where it is corrected. None of these pairs is presented anywhere in this document as independent corroboration, and none may be.

The two model-screening studies share their resumes. Wilson and Caliskan and Xu, Li and Jiang both draw their resumes from the same publicly available corpus. They test different classes of model, one retrieval and one generative, and ask different questions, but the documents being screened are one set. The sections on filter probability and on what the scores do not predict each say this in the sentence.

Two field experiments on online labour markets sit on one person’s platform relationships. John Horton is an author of Wiles, Munyikwa and Horton, and is thanked by name, with the platform, for help running the experiments in Pallais and Sands. Neither paper is disqualified by that. They are, together, evidence from inside one platform ecosystem rather than from two.

Two selection studies share an author. Bourdage is an author of both Bourdage, Roulin and Tarraf (2018) and Wingate, Robie, Powell and Bourdage (2025). The section on the Career Record cites both within a page of each other, for different findings, and they should be read as coming from one research group.

Where the version read is not the version of record

Nine of the sources above were read in a version that is not a journal’s version of record, and the document is locked to the version it read. This is not a suspicion. Each was checked against its own front matter, and the gaps are real.

Exley and Kessler locks to NBER Working Paper 26345, the May 2021 revision, whose cover states that NBER working papers have not been peer-reviewed.

He, Jachimowicz and Moore locks to a manuscript with no journal furniture at all.

Brown, Setren and Topa locks to New York Fed Staff Report 568, whose series note calls its contents preliminary.

Stephany, Teutloff and Leone locks to the March 2026 arXiv version, which is a working paper by its own description.

Wilson and Caliskan, Gerszberg, Hamori and Lo, and Xu, Li and Jiang lock to arXiv identifiers.

Farber, Silverman and von Wachter locks to NBER Working Paper 21689 for its tables and to the Papers and Proceedings companion for one comparison, and the two do not agree on every figure.

One source that might have been on this list is not. Bertrand and Mullainathan was read as the published American Economic Review article, volume 94, number 4, September 2004, and its table numbering is the numbering this document cites. It has a version of record, it was read in that version, and it is labelled accordingly.

Four polls on AI detection, and they are not four of a kind

The shortlist strength section draws on four vendor sources for what hiring managers say about machine-written applications. They are vendor polls, they are allowed on this question because nothing refereed measures it, and they are not equal.

Resume Genius and ResumeBuilder.com name their panel and their screens. Resume.io names its field date and its weighting. Robert Half names none of these, and sells the remedy in the same release. A reader who takes four sources as four independent measurements of the same thing has been misled, and this document has tried, in every sentence that cites one of them, not to be the thing that misled them. Where the four appear together, the weakest is labelled weakest in the sentence, and the passage from the weakest that the document carries is the one that cuts against its publisher’s interest.

What is reasoning, and what is a finding

The evidence ledger this document was built from marks five of its entries as reasoning rather than findings: an author’s interpretation of a result, or Cipher’s argument from a result, as distinct from something measured. The rule is that such an entry is written as reasoning wherever it appears, never as a result.

None of the five appears in this document. Each was considered for the section it was tagged to and not used, and a list of markings for sentences that are not on the page would be its own kind of error, so they are not listed here.

Where this document reasons rather than reports, it says so in the sentence. The direction part of career alignment is labelled a judgment in the place you read it. The rule that three scores are never combined is stated as a design decision that borrows no study. And every paragraph headed “What Cipher does differently” is Cipher’s decision, stated as one, and not a finding of the study above it.

The one label the papers did not settle

Every label in this document is taken from the source’s own pages. One question those pages could not settle is recorded here rather than resolved from outside.

The companion paper by Farber, Silverman and von Wachter sits in the Papers and Proceedings volume of the American Economic Review. The copy read carries the volume line, the digital object identifier, a running head reading “AEA Papers and Proceedings, May 2016”, an author footnote thanking a foundation for financial support, and a title footnote pointing to the article page for the authors’ disclosure statements. It carries no statement about how the papers in that volume were selected or whether they were refereed. The paper does not say, so this document does not say either. The refereeing status of that volume is not established here, and the companion is labelled that way where it is cited, alongside the working paper whose front matter does say what has and has not been done to it.

That is the standard this document holds itself to. A label is taken from the source or from a version of it that was read, and never from general knowledge about a venue. Where the source is silent, the label says so.