For your security team. The whole pack, before you sign anything.
Every document a security, legal or procurement review will ask for, available before a trial rather than after a contract. Most reviews finish in a week rather than a quarter, because the answers are written down already.
What is in it
| SOC 2 Type II | Audit targeted, not yet started. Scope and current status available now; the signed report follows once the audit completes |
| Penetration test | Most recent third-party summary, with remediation status |
| DPA | Data processing agreement, including standard contractual clauses |
| Sub-processor register | Every vendor that touches candidate data, what it touches, and its retention terms. Also public on the security page |
| Architecture and data flow | Where candidate data lives, who can read it, and the database permissions that keep names away from the scoring system |
| Bias audit package | Methodology, the publication format, and the current status, which is stated honestly on the bias audit page |
| Accessibility conformance | WCAG 2.2 AA report covering the interview room specifically, because an inaccessible interview is a discriminatory one |
| Retention and deletion | Default windows, configurable ranges, and how a deletion is verified rather than merely requested |
| Incident response | Severity definitions, notification commitments, and escalation contacts |
| Insurance | Certificates on request |
What we will tell you before you askLive is a young company. The SOC 2 window, the pen test date and the bias audit status are all stated with real dates in the pack rather than described as "in progress". If a control is not in place yet, the pack says which one and when it will be.
Already know what you are looking for? The security page, the AI transparency page and the bias audit page answer most of it in public, without a form.