Compliance

Not a background check provider / CRA. Simplehire is not a consumer reporting agency and does not produce "consumer reports" as defined under the U.S. Fair Credit Reporting Act (FCRA). Our certificate is candidate-initiated and is built from candidate-supplied inputs, consensual reference responses, and standardized skill evaluations.

A hiring aid, not a guarantee. Employers should treat our certificate as one input among several in their hiring process. It is not designed to be, and should not be used as, the sole basis for any employment decision.

• Candidate consent. When you create a certificate, you authorize us to process your resume, interview data, uploaded documents, and reference details, and to contact the references you provide.
• References. We only contact references that you supply. In our outreach we disclose your name and the purpose of the request.
• International users. Where applicable, we rely on consent, contract, and legitimate interests as our lawful bases for processing. You can exercise your rights — including access, correction, and deletion — as described in our Privacy Policy, or by contacting [email protected]. Where we transfer personal data across borders, we use appropriate safeguards (such as standard contractual clauses) as required by applicable law.

• Document scope. We capture images of IDs and visas to produce a status snapshot (for example: document type, validity dates, and redacted identifiers).
• No immigration advice. We do not provide legal opinions or advice on immigration or visa status.
• Data minimization. Sensitive numbers are redacted by default in the public/employer view. Full images remain encrypted and access-controlled internally, and are retained only as described in "Data retention & deletion" below.

• Transparent prompts. References are asked standardized, job-relevant questions.
• Bias reduction. We avoid questions designed to elicit protected-class information. Free-text responses are summarized and scored against consistent rubrics.
• Candidate review. You can view the status of your own certificate and request corrections where factual errors are identified in your own data.

• Human-in-the-loop. Our AI generates drafts and analyses; human reviewers check critical outputs before a certificate is issued.
• No automated adverse actions. Our scoring and summaries are assistive, not decisive. We do not make automated employment decisions about candidates.
• Model governance. We track model versions, testing sets, and drift, and we monitor for hallucinations, data leakage, and category errors.
• Data use. We do not use your private documents to train any public, third-party, or externally shared models. Any internal use of your data is limited to operating, securing, and improving the Simplehire service, consistent with this page and our Privacy Policy.

• Encryption. TLS 1.2+ in transit; AES-256 at rest.
• Access controls. Role-based access control (RBAC), least-privilege principles, SSO for administrators, and enforced multi-factor authentication (MFA).
• Isolation. Segregated environments for development, staging, and production, with managed secrets handling.
• Monitoring. Centralized logging, anomaly detection, alerting, and periodic key rotation.
• Backups & continuity. Daily encrypted backups, with recovery playbooks tested periodically.
• Vulnerability management. Regular dependency scanning, software bill-of-materials (SBOM) tracking, and defined patch service levels.

• 24/7 on-call. We triage incidents and work to contain, eradicate, and recover using documented runbooks.
• User notification. If a breach poses a risk to your data, we will notify affected users and, where required, applicable regulators within the timelines set by law.
• Responsible disclosure. Security researchers can report issues to [email protected]. We aim to acknowledge reports within 72 hours and to prioritize fixes.

We use reputable infrastructure and communication providers under data processing and confidentiality terms (for example: cloud hosting, email/SMS, payments, and analytics). The current list and data locations are available on request from [email protected] and updated when our vendors change.

• Accessibility. We aim to meet WCAG 2.1 AA, including keyboard navigation, visible focus, sufficient contrast, alt text, and captions where applicable. Report accessibility issues to [email protected].
• Equal opportunity. We prohibit the discriminatory use of Simplehire certificates and encourage employers to follow EEOC guidance and applicable equal-opportunity laws.

• PCI DSS certified processor. We never store raw card numbers. Payments are processed by Stripe, a PCI DSS Level 1 certified provider.
• Refunds. Refunds are governed by our Refund Policy.

• Default retention. Your resume, transcript, and certificate are retained for the life of your account, to support re-issue and sharing. When your account is closed, we delete or anonymize this data within a reasonable period, subject to legal holds and fraud prevention.
• ID/visa images. These are stored encrypted, with default redaction applied to shared views. Unless you opt in to keep them for updates, they are automatically deleted after a defined retention period.
• Your rights. You can request deletion via [email protected], subject to legal holds or fraud-prevention requirements.

You must provide accurate information and lawful documents. We provide structured evaluations but do not guarantee the accuracy of external statements (for example, referee opinions or government-sourced data). Misuse — including forgery or falsification — may result in suspension or revocation of your certificate.

We comply with applicable U.S. export control and sanctions programs. Access may be restricted in certain jurisdictions.

Our primary processing location is the United States, with approved subprocessors in other regions operating under contractual safeguards. The current list is available on request from [email protected].