We Tested CVoria’s Privacy Model. Here Is What Happened.
We tested CVoria’s own privacy model against Microsoft Presidio, GLiNER, LiquidAI and two hosted AI models on 200 new fictional CVs. Here are the results and the data.
Before CVoria sends a CV to an AI provider, our own privacy model replaces the personal details it finds, such as your name and contact details, with placeholders. We wanted to know how well that works, so we tested it on 200 new CVs it had never seen, against three open tools and two hosted AI models.
Short version
Our model left 23 of 757 core personal details readable, about 3%. The best open tool left 108 and Microsoft Presidio 299. Gemini 3.8 Flash and GPT-5.6 Luna, given our redaction rules, left 7 and 17, fewer than our model, but they have to receive your full CV to do it.
Why we remove personal details first
A CV is full of personal data, and most of the analysis does not need it. Feedback on your work history does not depend on your name, phone number or home address.
So your CV goes through our privacy model before the AI calls that use it. Each detail it finds becomes a placeholder such as [NAME_1], the same value always gets the same placeholder, and only that copy goes to the AI provider. Details the model misses are sent as written. Where the result needs your real details, for example the signature of a cover letter, CVoria puts them back itself. The model runs in our own account at Amazon Web Services in Stockholm, and if it cannot be reached, nothing is sent.
How the test worked
We needed CVs the model had never seen. Our earlier internal test sets shared some details with the training data, and we had used them to tune the model, so we wrote a new set for this benchmark.
Two AI models, Claude Opus 5.5 and GPT-6.1 Sol, each wrote 100 fictional CVs by hand: 150 excerpts and 50 complete CVs, 72 in Swedish, 108 in English and 20 in 15 other languages. Phone numbers come from ranges reserved for fiction, and every email domain was looked up and did not exist. Each model then marked the personal details in the other’s CVs without seeing the first answer key; the two keys agreed on 90% of the details, and we settled the rest. Scoring against either model’s own key instead changes the results by a few details and not the order.
The test set and the scoring were locked with checksums before any system ran. After the lock we changed two things, both documented in the data package: we replaced a profile link that could have reached a real person, and we fixed how the hosted models’ answers were processed, which had made them look worse than they are.
The measure is simple. After each system’s output is blanked out of the CV, how many personal details from the answer key can still be read? We count names, email addresses, phone numbers, street addresses, personal links, dates of birth and ID numbers as core details.
The results
| System | Readable (of 757) | Precision |
|---|---|---|
| CVoria privacy model | 23 (3.0%) | 94.2% |
| GLiNER multi PII | 108 (14.3%) | 77.4% |
| LiquidAI LFM2.5 PII | 199 (26.3%) | 88.9% |
| Microsoft Presidio | 299 (39.5%) | 37.1% |
| Gemini 3.8 Flash, given our rules | 7 (0.9%) | 100% |
| GPT-5.6 Luna, given our rules | 17 (2.2%) | 99.1% |
Readable counts the core personal details still visible; lower is better. Precision is the share of what each system removed that really was personal data. Our model left no phone number or ID number readable.
The hosted AI models did better
Given our written redaction rules, Gemini 3.8 Flash left 7 core details readable and GPT-5.6 Luna 17, fewer than our model’s 23, and both were more precise. We report that as it is.
The difference is where the work happens. To remove your details, a hosted model has to receive your full CV, details included. Our model runs in our own account in Stockholm, so the details it finds are replaced before the text reaches an AI provider.
Where our model still falls short
15 of its 23 misses were names, mostly in unusual forms: children’s first names, nicknames and call signs, and the candidate’s own name written as a citation (“Kothapalli, V.”). It is also clearly weaker than the hosted models on health, religion and immigration details.
It also sometimes removes things that are not personal data. The most important case is dates: 17 employment, issue, expiry and signing dates were removed, most of them as if they were birth dates, which takes part of your timeline away from the AI. Fixing that is the next model update, and we will test it on a new set before we quote numbers for it.
What we can and cannot claim
The CVs are fictional and written by AI models, so real CVs can differ. The answer keys follow the same rules our model was trained on, and we settled the disagreements between the two labellers ourselves. GPT-6.1 Sol wrote half the set and GPT-5.6 Luna comes from the same company; the whitepaper reports results by writer, and Luna left a larger share readable in Sol’s CVs than in Claude’s.
The benchmark measures how many personal details stay readable before text reaches an AI model. It does not make your CV anonymous: your work history, employers and dates stay in the text because the analysis needs them.
What we can say is narrower and still useful: on 200 new fictional CVs, our privacy model left far fewer personal details readable than Microsoft Presidio, GLiNER and LiquidAI.
Why we publish the data
A privacy claim should be checkable. The data package has all 200 CVs with their answer keys, every system’s output, both labellers’ keys and our decisions between them, the writing instructions and the scoring scripts. One command recalculates every table in the whitepaper and checks that the test set is the one we locked.
See it for yourself
Upload your CV to the CVoria resume analyzer and watch your details being replaced while the analysis runs.