Hiring Desk
An interview copilot on both sides of the table: evidence-first on the hiring side, a rehearsal trainer on the candidate's, with privacy that is architectural because no route out exists for either.
The problem. Every hiring tool asks for the most sensitive data a small company handles (CVs, dossiers, decisions, notes about people) and then answers the privacy question with a policy. A policy is a promise. The interesting question is what the topology permits.
What runs. Two planes that never merge. The private plane lives on the operator’s host: candidate data, dossiers, decisions, test authoring and scoring, a local datastore. It never listens on a public interface; it only reaches out. The public plane serves exclusively candidate-independent content — questions, not people — and therefore holds nothing personal to leak. Results come back through an outbound pull. The guarantee is not that data will not leave; it is that there is no route.
On the candidate’s side the same host runs a trainer for saying things out loud. A question bank is rehearsed on three rungs: read the script from a prompter, then speak from anchors, then answer with nothing in front of you. The answer is dictated live, text appearing while you speak, and a model marks it against what had to be said, quoting your own words for every mark. A read-through mode turns a topic into one page, and your own voiced answers play as a single track that keeps going with the phone in a pocket.
Designed next. A sparring mode, in which the interviewer interrupts, narrows and lets silence do its work, is specified and not built. Integrity signals over a remote interview’s audio and video: the defence against a second screen feeding the candidate answers. It belongs in the private plane by construction, which is exactly why the split had to come first.
The transferable part. Privacy as a property of the wiring, not of the promises. It holds on both sides here: candidates’ data and the owner’s own rehearsals stay on the host, and only what passes a publication gate ever leaves it. If the public surface never carries personal data, the compliance conversation is about topology rather than trust.
