Every score, every decision, every model call, is recorded with the candidate ID (hashed), the role ID, the model version, the prompt hash, the inputs, the outputs, and the timestamp. If a candidate, regulator, or your own counsel asks "why was this candidate not progressed?", we can answer in writing within minutes.

• ●Per-candidate audit JSON, available in the dashboard.
• ●Per-role bias report, available in the dashboard.
• ●Per-quarter aggregate report, emailed to admins.
• ●Independent annual audit, published on a public URL.
• ●Current model card, versioned. See /trust/model-cards.

We run a responsible disclosure policy. Email security@picked.ai with the details and we will reply within one business day. Critical issues get same-day triage. The disclosure policy and .well-known/security.txt on our domain confirm scope, safe-harbour terms, and the bug-bounty range (USD 100 to USD 5,000 depending on severity).

We are working toward SOC 2 Type II attestation, with Drata as the continuous-monitoring platform and Prescient Assurance as the independent auditor. The Type II observation window runs Q3 to Q4 2026; the letter of attestation lands at the end of Q4 2026. Trust criteria covered: Security, Availability, Confidentiality, Processing Integrity.

• ●Drata-monitored controls, live dashboard available to enterprise customers under NDA.
• ●Prescient Assurance independent audit.
• ●Pre-audit letter available now on request (legal@picked.ai).
• ●Type I observation window completed Q2 2026.