Trust
The page you can forward to your legal team.
It should answer the questions a data protection officer will ask, without a meeting. If something here is not clear enough to act on, that is a defect and we want to hear about it.
No automated decision about a person
Article 22 of the GDPR restricts decisions based solely on automated processing that produce legal or similarly significant effects. A hiring rejection qualifies. Candora is built so that the question does not arise: there is no reject path.
- No reject as an API route, a default value, or a pre-filled recommendation in the interface
- The system produces findings, a person produces decisions, and the decision is logged
- Enforced by a test that fails if an automated reject path is added
Facts, not probabilities
The product has no score column, no risk variable and no probability anywhere, including internally. This is a schema level constraint, not a presentation choice.
- Every finding asserts a checkable fact and names its source
- Every finding carries the time of the query and the version of the rule that produced it
- The database requires a source invocation on every finding, so a finding without traceable provenance cannot be stored
AI Act
Candidate screening in employment falls into the high risk category, with obligations applying from 2 December 2027. Candora is built to be auditable before then, and stays clear of the practices prohibited under Article 5 entirely.
- No emotion recognition, no deception detection, no behavioural inference
- No biometric categorisation and no biometric template of any kind
- Human oversight, logging and explainability designed in rather than added later
- Rule thresholds live in versioned data, so any past decision can be reconstructed with the rules that applied at the time
Where the data lives
Database, object storage and the serverless functions that process requests all run in an EU region. There is no third party outside the EU in the data path.
- The CV file is parsed in memory and never written to disk or object storage
- Only company and domain data is sent to external sources. The candidate's name never leaves Candora
- Row level security on every table, with tenant isolation enforced by the database rather than by application code
- Retention is configurable per organisation and defaults to 30 days for candidate data
Special categories are never touched
Health, religion, political opinions, trade union membership, sexuality and other special categories under Article 9 of the GDPR are never extracted, stored or displayed, even when a CV volunteers them.
- The extraction prompt forbids it explicitly
- A test checks the behaviour against a CV fixture that contains such data
- No checks relating to minors, at any point
The audit trail
Every event is appended, never edited or deleted, and carries the rule version in force when it happened. The application role has no update or delete rights on the event table, and a database trigger enforces it a second time.
- Who ran the check, when, against which rule version
- What the source returned and at what time
- Who reviewed the finding, what they decided and whether they overrode it
- Outcomes are tracked as their own record with history, so a candidate marked as a false positive later keeps both states
Something here not clear enough for your DPO?
Send the question and you get an answer in writing, not a call invitation.