Compliance
How Recruit100x supports compliant screening
Recruit100x is an assistive screening tool for recruiting agencies. This page explains what the product does, what stays your responsibility, and how candidate data is handled.
Not legal advice. Your obligations depend on where you and your candidates are and on how you use the reports. Confirm them with your counsel. Last updated September 4, 2026.
Our commitments
People decide. Always.
There is no automated rejection in Recruit100x — no code path turns a score into an outcome. Advance, hold and not-advance are recorded only when a named person records them, with history.
Notice and consent before anything is recorded.
Candidates read what the interview is, that AI conducts and summarizes it, who reads it, who decides, how long it takes and how long data is kept — then consent against a versioned notice pinned to their record.
Evidence, never a black-box score.
Facts are captured in the candidate's words; every rating quotes the interview; review signals are shown for human judgement and never affect ordering.
Candidate data rights built in.
Configurable retention with automatic anonymization, candidate deletion within a short grace period, legal hold, and a per-candidate compliance export.
What Recruit100x does, and what your agency must do
| Topic | What Recruit100x does | What your agency must do |
|---|---|---|
| Candidate notice | Shows the jurisdiction template before consent and pins the version the candidate saw. | Provide any advance notice your jurisdiction requires (for example NYC's 10 business days) at posting or invitation time. |
| Consent | Records consent with template, version, time and the invitation it belongs to; exports it on request. | Only invite candidates for roles where an AI-assisted screen is permitted and disclosed. |
| Decisions | Requires a named person for every decision and keeps the history in an immutable audit log. | Make the decisions, and apply your own selection standards consistently. |
| Bias audit | Collects no demographic data from candidates; aggregate outcome data is available on request. | Commission and publish any independent audit your jurisdiction requires (NYC LL144). |
| Retention | Anonymizes past-retention records automatically; enforces the California 48-month floor. | Choose a retention period consistent with your record-keeping obligations. |
| Deletion requests | Purges recordings, transcripts and personal details after a 7-day grace, with confirmation to the candidate. | Route candidate requests into the product promptly (Illinois: within 30 days of the request). |
We deliberately collect no demographic or protected-class data from candidates; the interviewer has a hard deny list (age, family plans, health, immigration status, restricted salary history and similar). For bias-audit purposes, aggregate outcome data is available on request.
By jurisdiction
Candidate-notice templates ship for each of these; owners pick the agency template under Settings → Candidate notices.
New York City — Local Law 144Notice 10 business days before an automated tool is used, plus a published bias-audit summary.
- Recruit100x
- The NYC notice template names the tool and the assessed criteria; the invite flow reminds you of the notice window.
- Your agency
- Give the advance notice, post your bias-audit summary, and offer an alternative process where required.
Illinois — AI Video Interview Act (AIVIA)Notify and obtain consent before an AI-analyzed interview; delete on request within 30 days.
- Recruit100x
- The Illinois template includes the consent statement; deletion requests purge within a 7-day grace, well inside 30 days.
- Your agency
- Act on deletion requests promptly and limit who can view recordings.
CaliforniaEmployment records kept four years; privacy notices under state law.
- Recruit100x
- The California template extends retention to a 48-month floor and includes the privacy statement.
- Your agency
- Serve your own privacy notice where required and keep selection records for the statutory period.
ColoradoBe prepared to explain how an AI system was used in a decision.
- Recruit100x
- Reports show exactly what the AI did (facts, quotes, ratings) and what a person decided.
- Your agency
- Provide the explanation to a candidate who asks.
Everywhere else (US base)Plain-language notice of AI-assisted screening and the human decision.
- Recruit100x
- The base template covers what, who, how long, and data retention.
- Your agency
- Keep job postings accurate about the use of AI screening where your state requires it.
Retention and candidate data rights
- · Default retention is 24 months from a candidate’s most recent screen, configurable per agency between 12 and 120 months. The California template enforces a 48-month floor.
- · Past retention, records are anonymized automatically: recordings, transcripts and personal details are deleted; the assessment, decision and consent record are kept in anonymized form.
- · Candidates can request deletion. Unstarted invitations are cancelled at once and the purge runs after a 7-day grace with an email confirmation to the candidate.
- · A legal hold pauses both clocks when a dispute or records request requires preservation. Only agency owners place or lift holds, and each change is audited.
- · A per-candidate compliance export bundles consent records with notice versions, the timeline, every report and the full decision history.
Security
- Encryption
- TLS in transit; encrypted storage at rest for the database and recordings.
- Recordings
- Reachable only through the report and client-link APIs — a signed-in member of the owning agency, or a client link the agency enabled. Recordings stored by Recruit100x are served through signed links that expire in minutes; recordings kept by the voice provider are fetched from the provider on request.
- Links
- Candidate and client links use 128-bit random tokens stored hashed (SHA-256) and compared in constant time.
- Tenant isolation
- Every query is scoped to the agency by guard code; an isolation test suite runs as a release gate.
- Analytics
- Candidate personal data never enters product analytics (validated at capture); error monitoring excludes candidate content.
- Prompt safety
- Candidate speech is untrusted input: the interviewer has no tools it can call, and attempts to instruct it are treated as ordinary answers, never as instructions.
- Access
- Owner and recruiter roles; owner-only billing, compliance and branding; every action audit-logged.
Last updated September 4, 2026. Full security overview
Subprocessors and DPA
| Vendor | Purpose | Data | Location |
|---|---|---|---|
| Vapi | Voice call infrastructure | Audio stream, transcript | United States |
| Deepgram | Speech-to-text | Audio | United States |
| OpenRouter | LLM routing (interviewing, reports, research) | Transcript text; no training | United States |
| Supabase | Database, authentication, recording storage | All application data | United States |
| Stripe | Payments | Agency billing details | United States |
| Resend | Transactional email | Email addresses, message content | United States |
| PostHog | Product analytics | Identifiers only — never candidate content | United States |
| Sentry | Error monitoring | Error context; candidate content excluded | United States |
| Langfuse | AI tracing | Prompt and completion text | United States |
| Inngest | Background job orchestration | Job identifiers | United States |
| Vercel | Hosting | Request data in transit | United States |
AI vendors are configured with no-training settings where offered. Last updated September 4, 2026.