Solutions · HR and TA leadership
Hiring governance for HR leaders who have to answer for the decision
HR leadership buys differently from the team using the tool. The question is not whether shortlists get faster. It is what happens when a rejected candidate asks why, when a regulator asks how, or when a hiring manager disputes a decision two quarters after the person who made it left.
The honest version of the AI risk is not bias in the abstract. It is a decision with no reconstructable basis. That is a records problem before it is a modelling problem.
Ask a vendor what is recorded, who it is attributed to, and whether the same inputs produce the same result. A tool that cannot answer those three is a governance liability regardless of how good the ranking looks.
What is actually recorded when a hiring decision is made?
Shortlist, select and reject are human actions. Each requires a written reason and is logged against a named recruiter with a timestamp. There is no auto-rejection and no pending state the system moves candidates into on its own, so there is no decision without a person attached to it.
- The criteria. The job description the candidate was evaluated against.
- The result. The score and every contributing factor, including the ones that scored zero.
- The person. Who decided, when, and the reason they wrote.
- The changes. Edits to weights, filters, skills, aliases and terminology are traceable to the person, the time and the before and after values, and require a reason.
That last one is the part most tools miss. A decision trail is only as good as the record of what the criteria were at the time, rather than what they are now.
How do you know the system is consistent?
Scoring is deterministic. The same job description and the same candidate inputs produce the same score every run. That is a testable property rather than a promise, and it is what makes an audit possible at all: a result you cannot reproduce is a result you cannot defend.
It also gives you a way to check the tool against your own history. Run a role you closed last year and compare the ranking to who you actually hired.
What does this mean under the DPDP Act?
Under the Digital Personal Data Protection Act your organisation is the Data Fiduciary for candidate data and a screening vendor typically acts as a Data Processor on your instructions. The obligations sit with you, which is why the vendor's records matter to you rather than to them.
It is worth stating plainly, because vendors overstate it: the DPDP Act does not contain a GDPR Article 22 style explicit right to an explanation for automated decisions. Anyone telling you it legally mandates algorithmic explainability is selling past the facts. Explainability is worth having because it makes decisions defensible, not because a statute names it. The DPDP page goes through this properly.
This is general information about a real consideration, not legal advice. Your own counsel should assess your specific obligations.
What can a security reviewer verify before we sign anything?
Data is stored and processed in Mumbai, India, on Google Cloud asia-south1, and CandidRanker's AI processing and its database are hosted in India. Workspaces are isolated at the database level with row security as defence in depth. Transport is TLS with encryption at rest. Uploads are malware scanned by default. Support access is read-only and time-bounded to a maximum of 24 hours, and separately logged.
MinMaxHR implements SOC 2-aligned controls, with independent certification on the roadmap. That is stated as alignment rather than certification deliberately, because asserting a certification that does not exist is the fastest way to fail a procurement review. The security page is the source of truth.
Frequently asked questions
- Who is accountable for a hiring decision made with AI assistance?
- A named person in your organisation. Shortlist, select and reject are human actions that require a written reason and are logged to a named recruiter. The system ranks and explains; it does not decide.
- Can we reconstruct a hiring decision months later?
- Yes. The criteria, the score and every contributing factor, the deciding recruiter, the timestamp and their written reason are all recorded, along with any changes made to scoring criteria and who made them.
- Does the DPDP Act require explainable AI in hiring?
- No. The DPDP Act does not contain a GDPR Article 22 style right to an explanation. Explainability matters because it makes a decision defensible, not because a statute mandates it.
- Is MinMaxHR SOC 2 certified?
- No. MinMaxHR implements SOC 2-aligned controls with independent certification on the roadmap. It is stated as alignment rather than certification until an audit report exists.
- Where is candidate data held, and where does the AI run?
- Data is stored and processed in Mumbai, India on Google Cloud asia-south1. CandidRanker's AI processing and its database are hosted in India.
- How do we verify consistency rather than take it on trust?
- Scoring is deterministic, so the same inputs reproduce the same result. Run a role you have already closed and compare the ranking against who you actually hired.