On this hosted instance the text you paste is sent over TLS to a model API outside your network, checked, and the answer comes straight back to your browser. It is not written to a database, a file or a log at any point in that journey, including the operations log described in the next answer, which has no field capable of holding it. Running the application inside your own network changes this: the text never leaves, because the model endpoint is yours as well.

Yes, and it is worth being exact about what. This instance keeps an operations log so that whoever runs it can see faults rather than wait to be told about them. Each entry is one of: a control was pressed, a screen was opened, a check completed, or something returned an error. A check entry holds counts and timings, so the number of flags, the score, how long it took and how many characters long the document was. That is all.

What it never holds is your document, any wording from it, its title, or the name of a file you chose. This is not a promise about careful coding: every entry is rebuilt on the server from a fixed list of permitted fields, so a field nobody named has no route into the log at all, and the one free text field is discarded outright if it reads like prose from a document. There is a test that runs the whole application and asserts the sample advert's own wording appears nowhere in anything the browser sent.

There is no third party analytics, no advertising identifier and no third party script. The only cookie is the one that holds an operations console session after somebody signs in with the console password, and no cookie is set for an ordinary visitor. The working record still lives in the memory of your browser tab and is gone when you refresh, which is why the interface tells you to download the PDF before you leave.

One entry per thing that happened: a control was pressed, a screen was opened, a check completed, or something returned an error. With each entry go the width of the window, whether the pointer is a finger or a mouse, and whether reduced motion is switched on. Those three explain almost every layout fault and identify nobody. There is no IP address, no browser fingerprint, no advertising identifier and no account, because there are no accounts.

Entries are deleted after thirty days, automatically, and whoever runs the instance can delete a day outright from the operations console before then. The console itself needs a password that is set in the deployment environment and never reaches this page.

Honest limitation: like a web server access log, this exists so faults can be found. If you would rather it did not exist at all, run the application inside your own network, where the log is yours and so is the decision about keeping it.

Usually not. An advert and an application form are employer authored documents describing a role, and they do not normally identify anyone. They can contain a recruiter's name or email, which is personal data about that person, so treat the check as processing that small amount. What this product will not take, at all, is a document about a candidate.

Because accepting them would change what this product legally is. Screening people would bring it inside the ICO's rules on automated decision making in recruitment and inside the EU AI Act's high risk recruitment category, and would put a data protection impact assessment in front of every sale. Refusing candidate data is the architectural decision the rest of the design rests on, so it is enforced in the server and cannot be switched off.

For the text you submit here, a processor acting on your instruction, since the check exists only to answer your question about your document. That is the honest description of the relationship rather than a completed legal analysis, and this hosted instance is a demonstration with no contract behind it. A data processing agreement belongs with a paid tier and does not exist yet. If you need one before using it, wait, or run it inside your own network where the question does not arise.

Not by this product, which keeps nothing and therefore has nothing to train on. What the model provider does with API traffic is governed by their terms, not by anything stated here, so check those directly rather than taking this page's word for it. This is exactly the kind of question where a confident answer from a supplier who cannot actually guarantee it is worse than no answer.

This has not been pinned for the hosted instance and this page will not pretend otherwise. The first party model API is global by default, and regional routing carries its own arrangements and price. If your organisation has a UK or EU data residency requirement, verify the current options with the provider before relying on the hosted instance, or run the application inside your own boundary against an endpoint whose location you already control.

Then your DLP policy is working. An internal role description or your own recruitment policy should not be sent to a third party, which is precisely why those capabilities are greyed out here rather than offered with a warning. They become available when the application runs inside your network, where those documents already are.

Only whoever holds the PDF or the JSON you downloaded. Nothing is published, nothing is shared and there is no link anyone else can follow, because there is nowhere for it to be stored. Retrieval by reference is a later phase and is not built.

The record carries the document title you gave it, the wording that was flagged, the provision behind each flag, what was decided, the reason typed for any override, timestamps, the rule set version and a SHA-256 hash of the whole thing. It also carries a hash of the document text rather than the text itself where it can. It never carries a candidate name, because none was ever accepted.

It proves less than people assume, and overclaiming here would destroy the product's value faster than any bug. The hash makes silent alteration detectable by anyone holding an earlier copy. It is not a trusted timestamp and it does not prove to somebody who was not holding a copy that the record existed when it says it did. The accurate word is tamper evident.

It is built on the assumption that someone will try. A document telling the engine to report no issues is treated as content and reported to you rather than obeyed, every quoted phrase is verified against your own text before you see it, and the legal citation is attached from a versioned rule set rather than written by the engine at all. A tool that could be talked into issuing a clean record would be worse than no tool, because it would manufacture false evidence.

The serverless function writes operational lines only: an error class, a status code, a request identifier, and a note when a document contains wording aimed at the engine. Document text is never written to a log. The platform keeps its own request logs, as any host does.

There is nothing held to delete. Close the tab and the working record is gone. If you downloaded a PDF, it is yours and only yours.