Compliance
How Recruit100x supports compliant screening
Recruit100x is an assistive screening tool for recruiting agencies. This page explains what the product does, what stays your responsibility, and how candidate data is handled.
Not legal advice. Your obligations depend on where you and your candidates are and on how you use the reports. Confirm them with your counsel. Last updated September 4, 2026.
Our commitments
People decide. Always.
There is no automated rejection in Recruit100x — no code path turns a score into an outcome. Advance, hold and not-advance are recorded only when a named person records them, with history.
Notice and consent before anything is recorded.
Candidates read what the interview is, that AI conducts and summarizes it, who reads it, who decides, how long it takes and how long data is kept — then consent against a versioned notice pinned to their record.
Evidence, never a black-box score.
Facts are captured in the candidate's words; every rating quotes the interview; review signals are shown for human judgement and never affect ordering.
Candidate data rights built in.
Configurable retention with automatic anonymization, candidate deletion within a short grace period, legal hold, and a per-candidate compliance export.
What Recruit100x does, and what your agency must do
| Topic | What Recruit100x does | What your agency must do |
|---|---|---|
| Candidate notice | Shows the jurisdiction template before consent and pins the version the candidate saw. | Provide any advance notice your jurisdiction requires (for example NYC's 10 business days) at posting or invitation time. |
| Consent | Records consent with template, version, time and the invitation it belongs to; exports it on request. | Only invite candidates for roles where an AI-assisted screen is permitted and disclosed. |
| Decisions | Requires a named person for every decision and keeps the history in an immutable audit log. | Make the decisions, and apply your own selection standards consistently. |
| Bias audit | Collects no demographic data from candidates; aggregate outcome data is available on request. | Commission and publish any independent audit your jurisdiction requires (NYC LL144). |
| Retention | Anonymizes past-retention records automatically; enforces the California 48-month floor; no floor outside the US. | Choose a retention period consistent with your record-keeping obligations — and no longer than you need. |
| Deletion requests | Purges recordings, transcripts and personal details after a 7-day grace, with confirmation to the candidate. | Route candidate requests into the product promptly (Illinois: within 30 days; one month under GDPR/UK GDPR). |
We deliberately collect no demographic or protected-class data from candidates; the interviewer has a hard deny list (age, family plans, health, immigration status, restricted salary history and similar). For bias-audit purposes, aggregate outcome data is available on request.
By jurisdiction
Candidate-notice templates ship for each of these; owners pick the agency template under Settings → Candidate notices.
New York City — Local Law 144Notice 10 business days before an automated tool is used, plus a published bias-audit summary.
- Recruit100x
- The NYC notice template names the tool and the assessed criteria; the invite flow reminds you of the notice window.
- Your agency
- Give the advance notice, post your bias-audit summary, and offer an alternative process where required.
Illinois — AI Video Interview Act (AIVIA)Notify and obtain consent before an AI-analyzed interview; delete on request within 30 days.
- Recruit100x
- The Illinois template includes the consent statement; deletion requests purge within a 7-day grace, well inside 30 days.
- Your agency
- Act on deletion requests promptly and limit who can view recordings.
CaliforniaEmployment records kept four years; privacy notices under state law.
- Recruit100x
- The California template extends retention to a 48-month floor and includes the privacy statement.
- Your agency
- Serve your own privacy notice where required and keep selection records for the statutory period.
ColoradoBe prepared to explain how an AI system was used in a decision.
- Recruit100x
- Reports show exactly what the AI did (facts, quotes, ratings) and what a person decided.
- Your agency
- Provide the explanation to a candidate who asks.
MarylandNotice and agreement before technology-assisted analysis of an interview.
- Recruit100x
- The Maryland template asks for the candidate's agreement to the analysis before the interview begins.
- Your agency
- Confirm the wording with counsel for your use; keep postings accurate about AI-assisted screening.
Rest of the United States (base)Plain-language notice of AI-assisted screening and the human decision.
- Recruit100x
- The base template covers what, who, how long, and data retention.
- Your agency
- Keep job postings accurate about the use of AI screening where your state requires it.
Outside the United StatesAutomated-processing notice: purpose, human review, the right to a human alternative and to deletion, retention, and how to contact the agency — no statute claims.
- Recruit100x
- The international template is jurisdiction-neutral and flagged for counsel review; retention has no floor, so you can set the shortest period that fits your process.
- Your agency
- Check your country's rules on automated processing, notice and consent (for example GDPR/UK GDPR Article 22) and on international data transfers — every sub-processor below is hosted in the United States — and adjust the template with counsel.
Retention and candidate data rights
- · Default retention is 24 months from a candidate’s most recent screen, configurable per agency between 12 and 120 months. The California template enforces a 48-month floor.
- · Past retention, records are anonymized automatically: recordings, transcripts and personal details are deleted; the assessment, decision and consent record are kept in anonymized form.
- · Candidates can request deletion. Unstarted invitations are cancelled at once and the purge runs after a 7-day grace with an email confirmation to the candidate.
- · A legal hold pauses both clocks when a dispute or records request requires preservation. Only agency owners place or lift holds, and each change is audited.
- · A per-candidate compliance export bundles consent records with notice versions, the timeline, every report and the full decision history.
Text messages
Agencies can choose to text candidates their interview link as well as emailing it. Consent to be texted is the agency’s to obtain: the agency is the sender of record, an owner accepts texting terms before turning it on, and a named member of the agency confirms consent on every import. Every text says how to stop — a reply of STOP, or a request in the candidate’s own words, ends texts from every agency at once — and texts only go out during daytime hours in the candidate’s local time. Each message, confirmation and opt-out is kept in the candidate’s compliance record; the wording of texts is deleted with the candidate’s data, while the opt-out itself is kept so it keeps working.
Security
- Encryption
- TLS in transit; encrypted storage at rest for the database and recordings.
- Recordings
- Reachable only through the report and client-link APIs — a signed-in member of the owning agency, or a client link the agency enabled. Recordings stored by Recruit100x are served through signed links that expire in minutes; recordings kept by the voice provider are fetched from the provider on request.
- Links
- Candidate and client links use 128-bit random tokens stored hashed (SHA-256) and compared in constant time.
- Tenant isolation
- Every query is scoped to the agency by guard code; an isolation test suite runs as a release gate.
- Analytics
- Candidate personal data never enters product analytics (validated at capture); error monitoring excludes candidate content.
- Prompt safety
- Candidate speech is untrusted input: the interviewer has no tools it can call, and attempts to instruct it are treated as ordinary answers, never as instructions.
- Access
- Owner and recruiter roles; owner-only billing, compliance and branding; every action audit-logged.
Last updated September 4, 2026. Full security overview
Subprocessors and DPA
| Vendor | Purpose | Data | Location |
|---|---|---|---|
| Vapi | Voice call infrastructure | Audio stream, transcript | United States |
| Deepgram | Speech-to-text | Audio | United States |
| OpenRouter | LLM routing (interviewing, reports, research) | Transcript text; no training | United States |
| Supabase | Database, authentication, recording storage | All application data | United States |
| Stripe | Payments | Agency billing details | United States |
| Resend | Transactional email | Email addresses, message content | United States |
| PostHog | Product analytics | Identifiers only — never candidate content | United States |
| Sentry | Error monitoring | Error context; candidate content excluded | United States |
| Langfuse | AI tracing | Prompt and completion text | United States |
| Inngest | Background job orchestration | Job identifiers | United States |
| Vercel | Hosting | Request data in transit | United States |
| TypeSafe | Structured assessment decisions (coverage, scoring, verification) over interview text | Interview text excerpts only — no contact details, identifiers or audio; ZDR requested — pending | United States |
AI vendors are configured with no-training settings where offered. Last updated September 4, 2026.
Data transfer: every sub-processor is hosted in the United States. Agencies in the EU, the UK and other jurisdictions with transfer rules should put a data-processing agreement with standard contractual clauses in place before inviting candidates — request one below.