Compliance at Recruit100x

Humans decide. Always.

There is no automated rejection in Recruit100x — no code path exists that turns a score into an outcome. Reports present stated facts, knockout results against rules you wrote, and evidence-quoted assessments. Advance, reject, and hold are recorded only when a named person clicks them, and every decision (and every change of decision) is kept in an append-only audit trail.

Disclosure and consent

Before anything is recorded, candidates see: what the interview is, that AI conducts and summarizes it, who reads the results, who makes the decision, how long it takes, what is assessed, and how long data is retained. Consent is captured against a versioned disclosure template; the version each candidate consented to is pinned to their record. Jurisdiction presets add the language NYC Local Law 144, the Illinois AI Video Interview Act, California, and Colorado expect. A human-alternative path is on every invite, and requesting it is never scored.

Retention and candidate data rights

• Default retention 24 months, configurable per agency (minimum 12, aligning 29 CFR 1602.14; California preset enforces a 48-month floor).
• Past retention, candidate records are automatically anonymized: recordings, transcripts, and personal details are deleted; the decision and consent record are kept where the law requires.
• Candidates can request deletion; purges run after a 7-day grace window with email confirmation (Illinois' 30-day statutory clock is surfaced in-product).
• Legal hold pauses both clocks when litigation requires preservation.
• A per-candidate compliance export bundles consent records, disclosure versions, timelines, reports, and the full decision history.

What we deliberately don't collect

We do not collect demographic or protected-class data from candidates, and interviewers are instructed never to ask for it (age, family plans, health, immigration status, salary history where restricted, and similar are on a hard deny list). For NYC LL144 bias-audit purposes, document this design choice in your audit methodology: score distributions by role and dimension are exportable, and no demographic attributes exist in the system to correlate against.

Your obligations as an agency

Depending on jurisdiction you may owe: candidate notice a set number of days before an AI-assisted interview (NYC LL144: 10 business days), an annual independent bias audit with a published summary (NYC LL144), candidate consent before recording (IL AIVIA), deletion within 30 days of a request (IL AIVIA), and privacy notices under state law (CA/CO). The product surfaces these where it can, but serving them is your responsibility. This is a summary, not legal advice — consult counsel for your situation.

Security summary

• Encryption in transit and at rest; audio behind short-lived signed URLs (≤10 minutes).
• Candidate and share links use 128-bit random tokens, stored hashed (SHA-256), compared constant-time.
• Agency data is isolated by guard-enforced scoping on every query, backed by an isolation test suite that runs as a release gate.
• Candidate PII never enters analytics (enforced by a validator at capture time) and is scrubbed from error monitoring.
• Candidate speech is treated as untrusted input: the interview AI has no tools, and instruction-injection attempts are treated as answers and flagged.

Subprocessors

AI vendors are configured with no-training flags where offered. A Data Processing Agreement is available on request: support@interview100x.com.