Hiring Desk

An interview copilot whose privacy is architectural — candidate data physically cannot leave the operator's host, because no path exists by which it could.

The problem. Every hiring tool asks for the most sensitive data a small company handles — CVs, dossiers, decisions, notes about people — and then answers the privacy question with a policy. A policy is a promise. The interesting question is what the topology permits.

What runs. Two planes that never merge. The private plane lives on the operator’s host: candidate data, dossiers, decisions, test authoring and scoring, a local datastore. It never listens on a public interface — it only reaches out. The public plane serves exclusively candidate-independent content — questions, not people — and therefore holds nothing personal to leak. Results come back through an outbound pull. The guarantee is not that data will not leave; it is that there is no route.

Designed next. Integrity signals over a remote interview’s audio and video — the defence against a second screen feeding the candidate answers. It belongs in the private plane by construction, which is exactly why the split had to come first.

The transferable part. Privacy as a property of the wiring, not of the promises. If the public surface never carries personal data, the compliance conversation is about topology rather than trust.