Your data is yours
Candidate records, notes, transcripts and messages belong to your workspace. They are not used to improve anything shared with another customer, and they are not sold, brokered or listed.
TRUST AND DATA / WITHOUT A LEGAL TEAM
You will be asked to explain this. Here is the answer.
Hiring software holds the most sensitive record a person will ever hand a stranger: their history, their salary, their reasons for leaving. This page says where that sits, who can open it, what gets checked before a decision moves, and how long any of it is kept.
Statements below describe how the product is built. Contractual commitments are made in your agreement.
Why was this candidate not progressed?
REASON GIVEN
The role requires a category C licence held for two years. The application records eight months.
WHAT THE RECORD HOLDS01 Source line Application, field 602 Approved by Named recruiter03 Delete on Retention + 12 months
SIX THINGS THAT ARE ALWAYS TRUE
The rules that do not have an exception.
These are structural rather than procedural. They are how the product is built, not a policy somebody has to remember to follow on a busy Friday.
Scoped by workspace
Every record is bound to one workspace and every query is filtered by it. A person only sees the roles, clients and candidates their seat allows.
Encrypted where it matters
Data is encrypted in transit, and the sensitive payloads sent to and returned from a model are encrypted before they are stored.
Approved before it sends
Nothing reaches a candidate, a client or a board without a recorded approval naming the person who gave it and the time they gave it.
Deleted on schedule
Applications, transcripts and notes follow the retention window you set per country. Deletion runs on its own rather than waiting for somebody to remember.
Explainable, on request
Every score cites the source lines behind it, and every rejection cites the requirement that was not met, in language a candidate can be given.
BIAS AND THE EU AI Act
Checked before it moves, not after somebody complains.
Automated support in hiring is a high-risk use under the EU AI Act, which is the right classification. We treat two moments as gates: the advert before it publishes, and the rejection before it sends. Both are blocked, explained and recorded if they fail.
- Advert wording screened for age, gender and ability constraints
- Rejection reasons tied to a stated requirement, never to a personal attribute
- Score distribution monitored per criterion, so one requirement cannot quietly do all the filtering
- A person can always overrule the rank, and the override is recorded with what the agent missed
- Candidates can ask for a decision to be reviewed by a person
WHAT A CANDIDATE CAN ASK FOR
Four requests, answered without a fire drill.
Access
A candidate can ask what you hold about them, and the workspace assembles it rather than a person searching six systems.
Correction
Wrong details are corrected on the record, and the correction is kept as part of the history.
Deletion
A deletion request removes the candidate from the workspace within the window you commit to, including transcripts and drafts.
Objection
A candidate can ask that a decision be reviewed by a person, and that review is recorded next to the original decision.
THE BOUNDARY IS PART OF THE PRODUCT
Where it runs, who can open it, what changes.
Hosted in the region you choose
Workspaces run in the region agreed at setup, and backups stay in that region.
Access is a seat, not a favour
Roles decide what a person can open. Support access is time-boxed and logged rather than standing.
Vendors are categories, not surprises
The processing categories used to run the product are listed in your agreement before anything is connected.
Change is staged
Model, scoring and prompt changes are evaluated against held-back cases before they reach a live workspace.
BRING US THE HARD QUESTION