Compliance

What Simplehire is (and isn't)

Lawful basis & consent (U.S. & global)

• •Candidate consent. You authorize us to process your resume, interview data, documents, and to reach your references.
• •References. We only contact references you provide. We disclose your name and the purpose of the request in our outreach.
• •International users. Where applicable, we rely on contract, consent, and legitimate interests. See our Privacy Policy for rights requests (access, correction, deletion).

Identity & Visa verification boundaries

• •Document scope. We capture images of IDs/visas to produce a status snapshot (type, validity dates, redacted identifiers).
• •No immigration advice. We do not provide legal opinions on immigration/visa status.
• •Data minimization. Sensitive numbers may be redacted in the public/employer view by default; full images remain encrypted and access-controlled internally.

References & fairness

• •Transparent prompts. References are asked standardized, job-relevant questions.
• •Bias reduction. We avoid questions that elicit protected-class info. Free-text responses are summarized and scored against consistent rubrics.
• •Candidate review. You can see status and request corrections if factual errors are identified in your own data.

Responsible AI

• •Human-in-the-loop. AI generates drafts and analyses; human QA reviews critical outputs before issuance.
• •No automated adverse actions. Our scoring and summaries are assistive, not decisive.
• •Model governance. We track model versions, testing sets, and drift; we monitor for hallucinations, leakage, and category errors.
• •Data use. We do not use your private documents to train public models.

Security controls (summarized)

• •Encryption. TLS 1.2+ in transit; AES-256 at rest.
• •Access controls. RBAC, least privilege, SSO for admins, MFA enforced.
• •Isolation. Segregated environments for dev/stage/prod; secrets management.
• •Monitoring. Centralized logs, anomaly detection, alerting, periodic key rotation.
• •Backups & continuity. Daily encrypted backups; recovery playbooks tested periodically.
• •Vulnerability management. Regular dependency scanning, SBOM tracking, patch SLAs.

Incident response

• •24/7 on-call. We triage incidents, contain, eradicate, and recover with documented runbooks.
• •User notification. If a breach poses a risk to your data, we'll notify affected users and (where required) regulators within applicable timelines.
• •Responsible disclosure. Security researchers can report issues to [email protected]. We acknowledge in 72 hours and prioritize fixes.

Subprocessors

We use reputable infrastructure and communication providers under DPA/confidentiality terms (e.g., cloud hosting, email/SMS, payments, analytics). The current list and data locations are available on request from [email protected] and updated when vendors change.

Accessibility & anti-discrimination

• •Accessibility. We aim for WCAG 2.1 AA: keyboard navigation, visible focus, contrast, alt text, captions where applicable. Report issues to [email protected].
• •Equal opportunity. We prohibit discriminatory use of Simplehire certificates and encourage employers to follow EEOC guidance.

Payment compliance

• •PCI DSS certified processor. We never store raw card numbers; payments are processed by Stripe, a PCI DSS Level 1 certified provider.
• •Refunds. Governed by our Refund Policy.

Data retention & deletion

• •Default retention. Resume, transcript, and certificate retained for account life (to support re-issue and sharing).
• •ID/Visa images. Encrypted with default redaction for shared views; optional auto-deletion after a specified period unless you opt in to keep for updates.
• •Your rights. Request deletion via [email protected] (subject to legal holds or fraud prevention).

Content accuracy & candidate responsibilities

• •You must provide accurate information and lawful documents.
• •We provide structured evaluations but do not guarantee accuracy of external statements (e.g., referee opinions, government data).
• •Misuse (forgery, falsification) may result in suspension or certificate revocation.

Export controls & sanctions

We comply with applicable U.S. export controls and sanctions programs. Access may be restricted in certain jurisdictions.

Where Simplehire operates & data location

Primary processing location: United States (with approved subprocessors in other regions under contractual safeguards). The current list is available on request from [email protected].