Compliance
Built for the law that applies to AI in hiring, not around it.
AI used to assess candidates is high-risk
From August 2026, tools that evaluate or rank job candidates carry high-risk obligations: transparency to the person, human oversight, logging, and accuracy. We built for that from the start rather than patching it on.
How we meet it
Every candidate sees exactly what is measured before agreeing. Every result is a list of evidence a human reads. There is no automatic decision anywhere in the code, and a test checks the output contains no hiring language.
Emotion recognition in the workplace is banned
Inferring emotions from face or voice in employment contexts is a prohibited practice. Some proctoring tools do exactly this and call it engagement scoring.
How we meet it
The camera model outputs geometry only: is a face present, where are the eyes pointing, are the eyelids closed. No emotion, mood, attention score or personality guess is computed, stored or shown. Spoken answers become text and the audio is deleted.
No biometric identification
Face data used to identify a person is special-category data. Matching a face to a stored template, or to a database, needs a legal basis most employers do not have.
How we meet it
We never identify anyone. The face landmarker does not produce an embedding, a template or an identity. It cannot tell you who is in frame, only that one face is. Nothing from the camera is stored, so there is nothing to match against.
Collect only what the purpose needs
A hiring assessment needs the work, the reasoning, and enough context to trust the result. It does not need video, location, device fingerprints or a browsing history.
How we meet it
What leaves the browser: the work, the messages to the AI teammate, quiz answers, two short transcripts, and simple counts. What never leaves it: video frames, audio, screen contents, keystrokes. Our servers store nothing; the result travels as a signed credential the candidate holds.
No decision based solely on automated processing
A candidate has the right not to be subject to a decision made only by a machine that significantly affects them.
How we meet it
PROOFOS never outputs hire, reject, pass or fail. It shows coverage, names the gap, and quotes the evidence. The decision is made by a person with that in front of them.
The right to an explanation
A candidate can ask why they got a number and is entitled to a real answer.
How we meet it
Nothing is stored as a score. Every number is calculated fresh from recorded moments, each quoted word for word with a timestamp, a fingerprint, and a label saying whether a computer or a model spotted it. Run it again and you get the same number.
The camera, in full
On for the whole test. Processed on your device. Never stored.
A camera in a hiring tool is only acceptable if the person can see everything it does, and it does nothing they cannot see. That is the standard we built to.
What the camera does
- Runs a face-landmark model inside your browser, on your device
- Checks whether the picture is blank, black or covered
- Checks whether one face is in view, none, or more than one
- Checks whether the eyes are on the screen, using eye-gaze geometry
- Turns all of that into seconds and counts, shown to you live
- Puts those counts, and nothing else, on the record
What it never does
- Sends a single video frame to any server
- Records, stores or replays any video
- Identifies you, matches your face, or builds a face template
- Guesses emotion, mood, attention, stress or personality
- Ends the test without telling you. Two clear warnings come first, on screen, and you can always stop yourself.
- Turns a count into a verdict. A person reads the numbers.
Thresholds are deliberately high. Glancing at notes or a keyboard is normal and never produces a flag. A flag appears only for long stretches, and reads as a count: “eyes off the screen 12 times, 130 seconds in total”, never as an accusation. This wording is covered by a test.
Technical guarantees
What an auditor can check for themselves.
Signed, verifiable offline
Results are issued as a signed credential. Anyone can check it in milliseconds with the public key, with no account and no call back to us.
Public key (DID) →Selective disclosure
The candidate chooses which skills to send. The signature still verifies. The employer can see something was withheld, but not what.
Try it on a passport →Freshness and revocation
Each skill fades on its own timer, so an old passport never reads as a fresh one. Revocation is one bit in a public list, checked without telling us which credential was asked about.
Verify a credential →Data inventory
Every piece of data, where it goes, how long it lives.
| Data | Leaves the browser? | Stored by us? | Ends up in |
|---|---|---|---|
| The work you write | Yes, for scoring | No | Your credential, as quoted moments |
| Messages to the AI teammate | Yes, for scoring | No | Your credential, as quoted moments |
| Trust quiz answers | Yes, for marking | No | Your credential, as a calibration score |
| Spoken answers | Text only; audio deleted after transcription | No | Your credential, as quoted moments |
| Paste, edit, time and focus counts | Yes | No | Your credential, as counts |
| Camera counts (blank, no face, eyes away) | Yes, as numbers | No | Your credential, as counts |
| Camera video frames | Never | Never | Nowhere. Discarded on your device. |
| Your face identity or template | Never computed | Never | Nowhere |
| Screen contents, keystrokes, location | Never collected | Never | Nowhere |