Security your IT team can sign off on.

Certifications

• SOC 2 Type II: an independent auditor has tested how our security controls work over time, not just how they were designed.
• ISO/IEC 27001:2022: our information security management system is certified to the international standard.
• ISO 9001:2015: our quality management system is certified, covering how we build, test and support Scout.
• GDPR ready: Scout is built to the EU General Data Protection Regulation’s requirements, described below. GDPR ready is our own assessment, not a certificate.

For copies of our certificates, the SOC 2 report or help with your security questionnaire, contact us at hello@bluerise.io or through the contact page.

Responsible AI

• Every call begins with the agent saying it is an AI. The disclosure is built into every agent, so none can skip it.
• When the employer records calls, the agent asks first. If the candidate says no, or the answer is unclear, the recording is deleted when the call ends.
• Scores come from what the candidate said, in the transcript, not from their voice, accent or tone. Scout never reads faces or emotions in video interviews.
• Scout never rejects or advances a candidate on its own. Every note links back to what the candidate said, and people at the employer make every decision.

GDPR and data protection

For candidate data, the employer using Scout is the controller and BlueRose processes the data on their behalf, on their instructions. For our customers’ account data and our website, BlueRose is the controller.

• Candidates are told the agent is an AI, and asked before anything is recorded.
• Each service provider receives only the data needed for its part of the service. We do not sell personal data or use it for advertising.
• Users can export their account data and delete their account from the console. Requests about candidate data are passed to the employer, and we help them respond.
• Data is deleted on a schedule, not kept forever (see below).
• Where the law requires it, we put appropriate safeguards in place for data processed in other countries.
• Laws such as the EU GDPR and India’s Digital Personal Data Protection Act 2023 give people rights over their data, and Scout is built so employers can honour them.

How we protect data

• Data is encrypted in transit between your browser, our servers and our providers.
• CVs are encrypted in storage, and ATS and phone-provider credentials are encrypted in our database.
• Each customer’s data is kept separate at the database level, and team roles control who can change what.
• Recordings and CVs are stored privately and opened only through links that expire within minutes.
• Passwords are stored only as a secure hash. Two-factor sign-in is available to every user, and a user can sign out every session at once.

Where data is processed

Scout’s databases and file storage are hosted by Amazon Web Services in the United States. Call audio is processed in India. Our AI and voice providers may process data in other countries; the privacy policy names each one and what it does.

How long data is kept

• CVs and the text extracted from them are deleted automatically 365 days after they are stored.
• Call recordings are deleted when the call ends unless the candidate clearly agreed to recording.
• Video interview recordings are deleted automatically after the workspace’s retention period, which the candidate is told before they agree to be recorded.
• When a user deletes their account, we remove their name, password and two-factor settings, anonymise their email address and end their sessions.

Try Scout without connecting your systems

Scout does not need your ATS to start. Add a role as a manual job, add candidates yourself and try the agent in your browser. Connect your ATS later, once your IT team is happy.