Decision support. Humans decide.

Model card

Known limitations (stated plainly)

• —Directional, not deterministic. The score is a probability signal, not a verdict. A high score does not guarantee retention; a low score does not mean a hire will fail.
• —Career-pattern risk only. It captures structural history signals — not management quality, team environment, or post-hire conditions that also drive retention.
• —Disclosed methodology ceiling. On candidates whose visible prior history is genuinely ambiguous, the system can be too pessimistic (pattern-break false-negatives). These cases are tracked and disclosed, not hidden.
• —Outcome cohort is currently building. The forward, real-world outcome-learning loop is architected and live but has not yet accrued a large outcome corpus. We say this out loud — see the methodology page.

Responsible-use statement

Ros informs human action; humans decide. Every output is a directional signal intended to help a manager or operator act earlier and more rigorously — not to replace the judgment that belongs in any serious hiring or retention decision.

Ros must not be used as the sole basis for any employment decision (hiring, termination, promotion, or compensation). This is stated in proposals and contracts, not buried.

Bias & adverse-impact posture

• —No protected-class inputs. Scoring uses structural career-history signals only.
• —Human-in-the-loop by design. The system surfaces signal; a human makes the call. This is the single most important control against automated adverse impact.
• —AI-disclosure attestation (NYC LL144-style). An AI-disclosure attestation is logged durably before any scan starts — the scan refuses to run if that record cannot be written.
• —Evidence-gated outputs. When the product shows "clear," it means checked-and-clear, not decorative. No synthetic proof, no fabricated case studies.
• —Planned, not yet claimed: an independent bias / adverse-impact audit and SOC 2 are on the roadmap. We do not claim either is complete today.

Data governance & security

• —Tenant isolation. Reads and writes are server-scoped by company; default-deny database rules are deployed and verified; access is gated on active billing status; cross-tenant data enrichment is rejected even when a foreign record is referenced by direct ID.
• —Encryption. Candidate resume content is encrypted at rest.
• —Access model. Enterprise tenants share data only within their own company scope; a canceled or inactive tenant is denied at the auth layer by design.

Data retention & deletion

We retain personal data only as long as it serves the purpose it was collected for. Where a record keeps analytical value after the person no longer needs to be identifiable, we anonymize it rather than keep it attached to a name.

• —Resume inputs. The uploaded file itself is never stored — only extracted text, held encrypted as queued scan input. Terminal queue inputs older than seven days are minimized by a guarded process: encrypted resume and job-description text plus candidate metadata are removed, while a reduced pseudonymized queue record is retained. The scheduled control is initially operating in dry-run mode while live minimization remains on demand; the purchased analysis remains available as your work product.
• —Your scans and reports. Retained while your account is active, and deleted after account closure. We do not expire deliverables you have paid for while you are still a customer.
• —Integration credentials. Google Calendar credentials are revoked and deleted when you disconnect the integration. Automated deletion based on inactivity is planned but is not yet enabled.
• —Operational records. Alerting, scheduling, delivery telemetry, and inbox events are deleted on fixed schedules; they carry no long-term analytical value.
• —Monitoring and outcome records. Anonymized once the monitoring and validation window closes — identifiers removed and quasi-identifiers coarsened (employer to sector, title to role family, exact dates to relative offsets), so cohort statistics survive but individuals are no longer identifiable.
• —AI-disclosure attestations & audit logs. Retained for at least four years to satisfy applicable state automated-decision system record-keeping rules (including California Civil Rights Department CRD regulations effective Oct 1, 2025 and NYC Local Law 144.1).
• —Erasure requests. Handled by anonymizing the individual rather than destroying the statistical record, so a person can be removed without corrupting outcome data already used for calibration.

Honesty architecture

Why the claims are defensible:

• —Predictions logged before outcomes. Prediction snapshots are persisted at scan time; the system cannot retroactively grade itself.
• —Proof chain. Each monitored hire has a visible timeline: risk flag → intervention scheduled/completed → employment outcome captured → learning eligibility, with honest complete / in-progress / insufficient states.
• —Financial claims are proof-gated. Prevented-attrition value is only claimed when flag → recorded intervention → retained outcome exists, in that order.

What we do not claim