Platform specification
How an AI interview becomes evidence: sequenced signed turns, a recruiter-reviewed packet, and a governed lifecycle. Published so partners can evaluate the model alongside the programmatic surface.
This page documents the evidence model that records production interviews today. The programmatic verification surface is self-serve for workspaces on an active Growth or Enterprise plan -- credentials are provisioned from Settings, and the format is published so it can be evaluated and challenged.
During a realtime interview, every final interviewer question and candidate answer is persisted server-side as a turn: its role, text, stage, server-assigned sequence number, and connection epoch. The ledger is written as the interview happens, under a per-session lease so exactly one connection can write at a time -- a reconnect or a second tab hands over explicitly rather than interleaving.
Because turns are sequenced by the server, the ledger preserves ordering even across disconnects, and a gap left by a dropped connection is recorded as a gap rather than papered over.
Each turn is signed with HMAC-SHA256 over a canonical serialization of its content and position. Keys live in a named keyring: the active key signs new turns, and verification accepts any ring member -- so keys rotate without orphaning previously signed evidence, and a configuration hash identifies which ring state produced a signature.
Signing answers one question precisely: has this turn's text, ordering, or attribution changed since the interview produced it?
An interview resolves into a packet built for human review: a summary, a scorecard against the pinned rubric, transcript excerpts anchored to their turns, per-question answer timings aligned to the recording, flagged risks, and the questions the interview left unresolved.
Packets are decision support, not decisions. Scoring output marked heuristic -- produced without full model evaluation -- is excluded from every automatic advancement gate, and manual recruiter evaluations are recorded with a durable audit trail of who scored what and why.
Rubrics are versioned and content-hashed, with an approval workflow ahead of launch authority. When an interview launches, it pins the rubric version, content hash, and question-set version it ran against. The evidence therefore names its measurement standard exactly -- a rubric edited after the fact cannot silently reinterpret past interviews.
Evidence ages out on configurable retention windows (measured from when the evidence was sealed, not merely created). Legal holds pause destruction for a company or an individual candidate, with the hold reason recorded. Candidate erasure removes evidence across every authority collection in a single transaction and verifies zero remaining records before committing -- an erasure either completes or does not happen.
The Evidence API centers on one call: present evidence, receive a verdict -- signature valid, sequence intact, rubric pin matched, lifecycle state disclosed. Workspaces on Growth or Enterprise provision their own credentials from Settings -> API access and can make that call today.