1 Provider identity
This system is provided by Vault Hire Limited, an applicant-tracking platform incorporated in England & Wales.
| Legal name | Vault Hire Limited |
| Registered office | Available on request from trust@vault-hire.com (Companies House search recommended for verification) |
| Primary contact | trust@vault-hire.com (compliance & AI governance) |
| Security contact | security@vault-hire.com (incident response, 24/7 monitored) |
| Data Protection Officer | dpo@vault-hire.com |
| EU representative | To be appointed prior to commercial release in the EU/EEA (target Q3 2026). Notified to deployer in writing on appointment. |
2 Intended purpose
Vault Hire is a hiring-process platform designed for the banking and financial-services sector. Its AI features assist (never replace) human decision-making at five identified workflows:
| Workflow | Audience | Data subject | Purpose |
|---|---|---|---|
| Candidate AI Profile generation | Candidate | The candidate | Generate a third-person, role-focused profile from the employment history the candidate has entered into their vault. The candidate must explicitly approve the output before it is shared with any employer. |
| AI Job Description writer | Recruiter | The recruiter (the JD is about a role, not a person) | Draft a banking-tailored, inclusive job description from a structured brief. |
| AI Compliance Response | Internal compliance / external customer | The asker | Draft an answer to a security or compliance question from a pre-curated knowledge base. Every answer is reviewed by a Vault Hire compliance officer before customer release. |
| AI Implementation Project summary | Internal PM | The PM user | Produce an internal + external status update for an enterprise implementation project from snapshot data. |
| AI Candidate overview for recruiters | Recruiter | The candidate | Propagate the candidate's previously-approved AI profile to a specific requisition. Gated by the candidate's data-subject opt-out (Art. 22). |
Intended NOT for
Vault Hire AI must NOT be used as the sole basis for any hiring decision. It must not be used to infer protected characteristics (race, religion, disability, sexual orientation, political opinion). It must not be deployed for emotion recognition or biometric categorisation in the recruitment context.
3 Capabilities & limitations
3.1 What the AI does
- Takes structured inputs the user has provided (employment records, JD brief, snapshot data).
- Generates natural-language output formatted for the relevant audience.
- Records every inference for audit (model version, prompt hash, output hash, timestamp, gate state).
- Defers to a human reviewer before any output is committed to the workflow (candidate approval, recruiter approval, compliance reviewer approval).
3.2 What the AI does NOT do
- It does not rank, score or sort candidates. Pack readiness signals are deliberately isolated from any model input.
- It does not autonomously progress a candidate, reject a candidate, or send any external communication.
- It does not access personal data fields excluded from the prompt (full name, email, phone, home address — verified by automated test).
- It is not trained on Vault Hire customer data. Model providers operate under explicit no-training contractual terms.
3.3 Foreseeable misuse to avoid
- Using AI Job Description output as final copy without recruiter review — the AI may include regulatory references that do not apply to a specific role.
- Forwarding the AI Candidate overview to anyone outside the requisition without re-checking the candidate's current consent state.
- Relying on AI Compliance Response for legally-binding answers without compliance-officer review.
4 Accuracy, robustness, cybersecurity
4.1 Accuracy metrics
Vault Hire does not train its own models. We use Anthropic Claude Sonnet 4.5 via the Emergent integrations gateway. Published benchmarks for that model are available from Anthropic. Our internal evaluation of model output quality on the five workflows is summarised below; the full evaluation methodology, dataset and per-workflow scores are available under NDA.
| Workflow | Evaluation method | Pass-rate target | Current pass-rate |
|---|---|---|---|
| Candidate AI Profile | Candidate approval rate on first generation | ≥ 85% | Currently tracking (cohort < 100, statistically inconclusive) |
| AI Job Description | Recruiter approval rate after <3 edits | ≥ 80% | Currently tracking |
| AI Compliance Response | Compliance-officer approval rate after light edit | ≥ 75% | Currently tracking |
| AI PM Summary | PM-user approval rate before send | ≥ 85% | Currently tracking |
| PII leak rate (any workflow) | Automated test against forbidden PII fields in prompt | 0% | 0% (verified by test_ai_profile_prompt_has_no_pii_fields_in_source) |
4.2 Robustness
Each AI call is wrapped in a timeout + error handler. On model failure, the workflow returns a clean error path (no partial output, no truncated state). The model gateway has a documented retry-with-backoff policy.
4.3 Cybersecurity
The AI gateway is invoked over HTTPS with a server-side API key never exposed to the browser. Prompt and response are logged as SHA-256 hashes only — never the plaintext payload — to limit blast radius if the audit store is ever compromised. The full network architecture is described under NDA.
5 Human oversight measures
Article 14 of the EU AI Act requires that high-risk AI systems are designed for effective human oversight. Vault Hire's oversight design has six elements:
- The data subject is the first reviewer. For every candidate-related workflow, the candidate must explicitly approve the AI output before it leaves their vault.
- The recruiter is the second reviewer. No AI output is auto-published to a hiring manager or third party.
- Per-tenant opt-out at the request boundary. The deployer's owner can switch AI off globally or per workflow. The gate is enforced before the model is invoked.
- Per-data-subject opt-out at the request boundary. Each user can switch AI off on their own account. The gate is enforced before the model is invoked.
- Audit-first design. Every AI inference records model version, prompt hash, output hash, reviewer ID, and gate state. The audit trail is the artefact, not the prompt.
- Drift surfacing (planned, Q3 2026). A drift-detection job will surface gate-blocked rate, override deltas and false-positive rate per workflow per tenant. Required by Art. 72 post-market monitoring.
For the deployer
You should designate at least one natural person inside your organisation who is responsible for monitoring Vault Hire AI outputs in your hiring pipeline, reviewing the audit trail at least quarterly, and is competent to interpret limitations described in §3 above. We recommend the role be held by a Senior Manager for SMCR alignment.
6 Changes & performance over time
Material changes to AI behaviour (model version upgrade, prompt revision, new workflow added, gate behaviour changed) are recorded in the public changelog at /legal/instructions-for-use-changelog.html (in preparation; until publication, changes are emailed to deployer DPO contacts).
Vault Hire will notify deployers in writing at least 30 days before any change that would materially alter the accuracy or limitation profile in §3 / §4.
7 Compute, lifetime & maintenance
- Hardware: hosted in EU cloud regions on encrypted virtualised infrastructure. Full region map under NDA.
- Model: Anthropic Claude Sonnet 4.5 (current). Subject to versioning per §6.
- Expected lifetime: indefinite, subject to ongoing maintenance. Deployers will receive at least 12 months' notice of any planned end-of-life.
- Maintenance: security patches applied within 14 days of public CVE disclosure for severities > Medium. Higher-severity items follow our incident-response runbook (available under NDA).
- Operating constraints: require an internet connection to the LLM gateway. AI features are non-functional in air-gapped environments.
8 Interpreting the output
Every AI output in the user interface is accompanied by:
- A clear "generated by AI" disclosure label.
- The model version that produced it.
- A timestamp of generation.
- The action panel for the human reviewer (approve, edit, reject).
Outputs should be read as drafting assistance and signal aggregation, not as a recommendation, decision, or instruction. A user who is not satisfied with an output should reject it; the rejected output is recorded for model-feedback purposes (subject to the data subject's consent for that recording — Art. 6(1)(f) legitimate interest, balanced against the data subject's rights).