Vault Hire is engineered to satisfy the controls expected of banking, fintech and regulated-industry recruitment. Below is what we have implemented today — verifiable, not aspirational.
For banking buyers · NDA-gated
The case against legacy ATS architecture
A board-ready briefing for the Senior Manager who will personally sign off on this system under SMCR. Why retention is now the liability, what we hold vs. what a legacy ATS holds, and the line that closes the deal. NDA + owner approval required.
Every AI inference logged in an audit register (6-year horizon)
AI-generated content clearly disclosed in the UI
AI features can be disabled per tenant, per workflow, per data subject — honoured at the request boundary
No customer data used for model training — ever
Human-in-the-loop required for any hiring decision
EU AI Act Article 22 opt-out is the architecture, not a setting
Banking compliance
6-year retention on audit logs & completed references (POCA/FCA aligned)
Companies House verification on all employer accounts
OpenSanctions screening hooks for KYC workflows
Tamper-evident audit log across every regulated artefact
Cryptographic vault with time-limited employer access
Anonymity-by-default for references; reveal only on candidate consent
FAQ
Common questions.
Where is my data stored?+
Customer data sits in encrypted clusters hosted in EU regions, with field-level encryption on personal data and rotation-friendly keys. Full sub-processor list and region map available under NDA.
How do I export or delete my data?+
Any signed-in user can hit Settings → Data & Privacy → Export (GDPR Art. 15) or Request erasure (Art. 17). Erasure runs after a 30-day cool-off so accidental deletions can be reversed.
Do you use my data to train AI models?+
No. We use enterprise LLM providers via API only, with explicit no-training contractual terms. Your data is never sent to model providers for training purposes.
Is Vault Hire SOC 2 / ISO 27001 certified?+
We are pre-pilot. SOC 2 Type I readiness assessment is on the FY26 roadmap. The controls listed above are already operational and independently audit-ready.
Procurement & due-diligence
Everything your procurement team asks for, in one place.
Our Legal & Compliance Library hosts the four artefacts banking procurement and DPO teams ask for in week one: Instructions for Use (EU AI Act Art. 13), Data Processing Agreement (UK GDPR Art. 28), sub-processor list, and a fillable DPIA template.