The questions buyers actually ask, answered before the call

Can a candidate be rejected automatically by a flag or a score?

No. Nothing in this product moves a candidate to a rejected state on its own. An integrity score exists so a reviewer knows which sittings to open first, and every point of it traces to a finding a person can watch. There is exactly one code path that writes a decision about a candidate, and it requires a signed-in user with a role and records who they were.

How findings are raised, and what each one is worth, is on proctoring and integrity evidence.

Can a candidate appeal or challenge a flag?

Yes, and there is something concrete to appeal against. Because the whole sitting is replayable with the evidence on the same timeline, a challenge is a conversation about a specific moment rather than about a number nobody can explain. Where an AI system was involved in an interview, the candidate-facing notice carries a named route to human review, and the product refuses to publish a notice that requires one and does not have a contact set for it. The decision itself is always yours as the employer: this product is the record, not the arbiter.

What stops an honest candidate being wrongly accused?

The thresholds and the guards. A large insertion is only raised above 250 genuinely new characters in one editor event, against a corpus in which the largest real multi-character edit ever observed was 62. Four provenance guards then account for rewrites, for a candidate moving their own text back, for duplicating a block already on screen, and for carrying their own typing between questions. A camera finding needs three consecutive corroborating frames spanning at least 45 seconds, and every camera finding is worth zero points by default. Signals that cannot distinguish an innocent explanation from a guilty one are recorded, shown, and scored at nothing.

The suspicions the system examined and dropped are shown too, as first-class items on the timeline — see session replay.

What happens if a candidate’s connection drops mid-assessment?

Their answers are saved locally as they work and synced to the server, and a resume reconciles the two copies by which is newer rather than by which is convenient. Where a reload left a stretch unrecorded, that gap is written down and shown to the reviewer — and it is worth zero points, because a crash, a closed lid, an operating-system update and a deliberate escape are indistinguishable from the gap alone. Resuming on a different machine is detected and graded as something to look at, not as a failure, because the honest cases are real.

What if a candidate needs extra time, breaks, or a screen reader?

Extra time, rest breaks, screen-reader mode and integrity exemptions are granted per candidate, and every grant requires a written reason. A grant cannot be deleted, only revoked with its own reason, and every change appends a record naming who made it. That trail is what answers a complaint months later, which is why there is no delete endpoint for it and there must not be one.

Can a candidate see what was recorded about them?

In almost every deployment you are the data controller and this product is the processor, so a candidate exercises that right with you rather than with us. What the product provides is the machinery to serve it: a machine-readable export of everything held on one person, with time-limited links to their media, produced by an account owner.

Do you have SOC 2 or ISO 27001?

No. This system holds neither, and the Trust Centre inside the product says so first, before anything else. If either is a hard requirement in your process, that is the honest place to stop rather than three weeks into an evaluation.

Is this GDPR-safe?

That is not a property a product can have on its own — it depends on your lawful basis, your notices and your retention decisions, and in almost every deployment you are the controller. What the product provides is the machinery: subject access exports, erasure that reaches object storage and verifies deletion before touching the database, a retention policy you set per class of data, an append-only audit trail, a sub-processor list generated from the live configuration, and candidate-facing AI notices that resolve to the right wording per jurisdiction. There is one gap worth knowing before your DPIA: there is no stored per-candidate Article 9 consent artefact for proctoring capture, so if your basis for recording rests on consent, that record has to come from your own process today.

The whole posture, including the parts that are uncomfortable, is on security and data protection.

What data do you keep, and for how long?

Screen and webcam recordings of proctored sittings, short clips around each finding, the edit stream behind every answer, submissions and scores, interview scorecards, and the ordinary candidate record. Retention is a policy you set per class of data, and the product ships no default window — which means anything you have not configured is kept until somebody deletes it. That is stated rather than hidden: the Trust Centre prints how many of your data classes have a window and how many do not.

What happens to recordings when we delete a test?

Deleting a test cascades in the database and takes the description of its recordings with it, which is precisely how footage of real people ends up in storage that nothing in the product can see. Recording assets are therefore written to a ledger that is deliberately not cascaded, so the footage stays attributable — and therefore deletable — after its session record is gone. A retention sweep still requires an explicit non-dry-run and an enabled policy before anything is removed.

Is our data separated from other customers’ data?

Yes, and the mechanism is worth stating rather than asserting. There is no customer-facing endpoint that accepts an organisation identifier from the client: it is read from the verified token and applied again inside the service layer. A record belonging to another organisation answers 404 rather than 403, because a 403 confirms the identifier exists and existence is itself a disclosure. Child records — a clip, a comment, a file, a finding — are never reachable by their own identifier alone.