A user asked us this last week: "what's the agent actually doing between my YES and the confirmation message?" Fair question. The honest answer is: more than it looks like, less than you might fear.
Here's the full timeline.
T+0s — Your YES lands
Meta's WhatsApp Cloud API delivers your message to our webhook. We validate the HMAC-SHA256 signature on the request before doing anything else — if it doesn't match, we drop the message on the floor. Drop quietly, return 200, move on. (This isn't paranoia. Without this check, anyone could spoof messages to our webhook and trigger applications.)
T+0.1s — We figure out what your YES applies to
We look up the last role we surfaced you and confirm there isn't an older unread role still waiting. We never apply to a role we didn't just propose — the YES is scoped, not a standing order.
T+0.5s — The job goes onto a queue
We don't run the tailoring synchronously. The webhook returns 200 to Meta immediately (this matters — non-200 responses get retried, and eventually Meta disables your webhook). The actual work happens on a Celery worker, on the queue tagged default for application-flow tasks.
T+5s — Tailoring begins
A worker picks up the task. It pulls your latest resume from our encrypted store, pulls the full job description from the source we surfaced it from, and hands both to an LLM. The prompt is short: rewrite the resume to fit this role, keeping every fact intact. Rephrase, don't fabricate. That's a rule, not a suggestion — we'd rather submit a less-polished application than a fabricated one.
The LLM is on a machine we operate ourselves. We don't ship your resume to a third-party model provider for the tailoring step.
T+45s — The cover letter
Same flow. The cover letter draws from your actual background — projects, companies, technologies you've worked with — and connects them to the specific role's stated needs. If a connection isn't there, we don't invent one.
T+90s — Filling the form
The agent walks the company's careers-page application form, fills in basics from your profile (name, email, location, work authorization), and attaches the tailored resume and cover letter. For free-text questions ("why this company?"), it drafts an answer in your voice based on what you've told us in past conversations.
T+150s — Submitting
The agent clicks the company's submit button. We capture the post-submit confirmation page (the one that says "thanks, we've received your application") and store it as proof.
T+155s — You get a confirmation on WhatsApp
"Applied. ✓ I'll ping you when they reply." That's the whole loop. Sometimes faster, sometimes slower depending on the company's form. Almost always under 8 minutes.
What we don't do during this window
- Read your other WhatsApp chats. Meta's API doesn't expose them.
- Share your resume with any third party. The only places your resume travels are: our database, our LLM machine, and the application form itself.
- Apply to a role you didn't say YES to. The agent has no standing authority to apply on its own — we're built around explicit consent.
If you want to see the same flow with even more detail, the Trust & Security page goes deeper. And if there's a step we should be more transparent about, just tell us.