The page you can forward to legal and security.
What Provicio collects, what it does with it, how long it keeps it, and where it stands against the automated-employment-decision rules now in force. Written plainly, with the gaps stated.
Last updated September 2026. This page describes how the product is designed and operated; it is not legal advice, and it is not a substitute for your own counsel's review.
The short version
- Candidates consent before anything is recorded, and the consent screen says what is captured, why, what happens to it, and for how long.
- Audio is used only to produce a transcript and is then deleted. Analysis is transcript-only. Provicio does not create voiceprints, does not analyze voice stress, tone, or emotion, and does not store biometric identifiers.
- Candidates review and can correct their transcript before it is submitted.
- Every result is labeled for human review. Provicio never auto-advances or auto-rejects a candidate and does not produce a hire/no-hire recommendation.
- Customers get an exportable decision log retained for four years, a candidate-notice template, and this page's contents as a one-page document.
- Provicio has not yet commissioned an independent bias audit. What we do about disparate impact today is described below.
What is collected
| Data | From whom | Purpose | Retention |
|---|---|---|---|
| Resume (file and parsed claims) | Customer | Source of the claims being checked | Duration of the customer relationship, or on deletion request |
| Candidate name and email | Customer | Sending the invitation; labeling the result | Same as above |
| Audio of spoken answers | Candidate | Transcription only | Deleted immediately after transcription completes |
| Transcript (candidate-reviewed) | Candidate | Comparison against claims; available to the customer's reviewers | Duration of the customer relationship, or on deletion request |
| Per-claim verdicts, confidence level, reasoning | Generated | Decision support for the customer's human reviewers | Four years (decision log) |
| Reviewer actions (who viewed, what they decided) | Customer | Decision log; audit support | Four years |
Provicio does not collect or infer age, race, ethnicity, national origin, sex, disability status, or any other protected characteristic, and does not use accent, dialect, or fluency as an input to any verdict.
Consent and candidate experience
Before recording, candidates see a consent screen stating who is asking (your organization), why (verifying the experience described on their resume), what is captured (spoken answers), what happens to the audio (transcribed, then deleted), what is kept (the transcript they approve and the resulting comparison), how long, and that a human at your organization will review the result. Candidates can decline. After answering, they see their full transcript, can correct recognition errors, and submit only when satisfied. They are not shown the per-claim verdicts; those go to your reviewers.
Human review, not automated decisions
Provicio is designed as decision support. It outputs a confidence level and per-claim reasoning; it does not rank candidates against each other, does not produce a pass/fail, and has no setting that advances or rejects anyone automatically. Every result is labeled “for human review.” We ask customers to treat a low-confidence result as a prompt to look at specific claims, and, where practical, to ask the candidate about them, not as a rejection. The reviewer's decision is recorded in the decision log alongside the result.
Fairness and speech recognition
Automatic speech recognition makes more errors on accented and non-native speech. Left alone, that would be a disparate-impact risk: a mis-transcribed detail could look like a missing one. Provicio addresses this in three places. First, candidates review and correct their transcript before submission, so recognition errors are fixed by the person best placed to fix them. Second, the analysis scores the presence of specific, consistent detail, never fluency, grammar, vocabulary, or delivery. Third, results are for human review, so a reviewer can read the transcript directly whenever a verdict looks off.
We monitor completion rates and confidence-level distributions for anomalies, and we will share aggregate figures with customers on request. We have not yet commissioned a third-party bias audit. We intend to once there is enough production volume to audit meaningfully, and we will cooperate with any customer-commissioned audit in the meantime.
Regulatory landscape (as we understand it)
Each rule links to its primary source. Summaries are ours; read the source or ask your counsel.
| Rule | What it requires | How Provicio helps |
|---|---|---|
| NYC Local Law 144 (in force 2023) | Annual independent bias audit and 10 business days' candidate notice for automated employment decision tools | Candidate-notice template supplied. Human-review design intended to keep Provicio decision support rather than the deciding factor. No independent audit yet; see above. |
| Illinois HB 3773 (in force Jan 2026) | Notice to candidates when AI is used in employment decisions; prohibits discriminatory effect | Consent screen and notice template. Transcript review and detail-only scoring to reduce disparate impact. |
| California FEHA regulations (Oct 2025) | Vendor treated as employer's agent; four-year retention of decision data | Four-year decision-log retention and export. Provicio accepts agent obligations contractually. |
| Colorado SB 26-189 (replaces the 2024 Colorado AI Act; effective Jan 1, 2027) | Clear notice before automated decision-making technology is used in hiring; a plain-language explanation within 30 days of an adverse decision it influenced; meaningful human review on request; three-year record retention | Notice template. Per-claim reasoning doubles as the plain-language explanation. Human-review design. Decision log retained four years, beyond the three required. |
| Illinois BIPA and other biometric-privacy laws | Consent and retention rules for biometric identifiers, including voiceprints | Provicio does not create voiceprints or retain audio. Transcript-only analysis is a deliberate architectural choice to stay outside biometric scope. |
Security
Customer data is isolated per account, encrypted in transit and at rest, and accessible only to the customer's authenticated users. Provicio staff (currently, the founder) access customer data only to provide support and only with the customer's knowledge. Data is exportable and deletable on request. We're a small company and don't yet hold a SOC 2 report; we will complete your security questionnaire and answer follow-up questions directly.
What we give every customer
- Candidate consent screen (built in).
- Employer-facing candidate-notice template covering NYC and Illinois requirements.
- A one-page “what we flag, what we don't, how data is handled” document, which is this page in PDF form.
- Decision-log export, retained four years.
- A direct line to the person who built it, for any question your counsel or security team has.
Have a question this page doesn't answer? Email Ben. Security questionnaires, DPA requests, and pointed questions from counsel are all welcome.