1Security & access
Staff sign in via SSO; access tokens are held in memory rather than local storage, with a short-lived, httpOnly refresh cookie.
Permission-based (RBAC) access control — a role × permission matrix, not fixed job-title roles.
Soft deletes with a full audit trail — records are recoverable, and every mutation is logged.
Rate-limited public endpoints (candidate links, client verification) to reduce abuse.
2Assessment integrity
Optional Safe Exam Browser lockdown for timed IQ and work-sample assessments.
Server-side timers with automatic finalization — a candidate can't extend a session by closing the tab.
3Evaluation & reporting
Multiple evaluation rounds per candidate — closed rounds stay intact as readable evidence.
A weighted Evaluation Summary — one composite score across whichever stages are complete, renormalized so a round doesn't need every stage finished to get a directional read.
The hire/no-hire Final Call is always a human decision — AI drafts supporting narrative, it doesn't make the call.
4Integrations
Microsoft Entra ID or Amazon Cognito for staff sign-in.
Microsoft Graph / Teams for panel scheduling, recording, and transcript sync.
Amazon S3 for resume, video, and photo storage; Amazon SES for transactional email.
Anthropic Claude and Whisper for resume parsing, stage scoring, and video transcription.
5Open items
Peer percentile ranking on aptitude scores and configurable stage weighting are on the roadmap; today's composite score uses fixed weights.
