Gloat

A dedicated ethical AI page sets out five principles (enhancing rather than replacing human decision-making, fairness as a north star, proactive monitoring and auditing, ongoing transparency, accountability) and states that users can learn why particular candidates and opportunities were suggested, removing the "black box" around AI suggestions.

https://gloat.com/about-us/gloats-commitment-to-ethical-ai/

The AI technology page describes the system architecture (knowledge graph, 14 intelligent tools, personalization engine, proprietary embedding models) and asserts that "What was considered. What was excluded. Why. Every decision is transparent and auditable," but links no model card, whitepaper or methodology document.

https://gloat.com/ai-technology/

A Governance Engine page documents six enforced rule categories (approval workflows, access and permissions/RBAC, eligibility criteria, org hierarchy, compensation bands, compliance policies) and states that agents "can tell users why - and what alternatives exist."

https://gloat.com/ai-technology/governance-engine/

No model card, system card, technical documentation pack, ISO/IEC 42001 certification or EU AI Act reference was found across gloat.com's page sitemap, the security-and-compliance page, the four ai-technology pages, the ethical AI page, or a site-restricted search for "ISO 42001" and "AI Act".

Have a URL that disputes this?→

Gloat claims "regular algorithmic auditing" comprising "continuous self-monitoring of models" and "third-party audits," and says customers "have the ability to test how models behave in their environment"- but names no auditor, gives no date, methodology or impact-ratio results, and links no report.

https://gloat.com/about-us/gloats-commitment-to-ethical-ai/

No NYC Local Law 144 bias audit summary or AEDT notice was found anywhere on gloat.com, despite LL 144 covering the screening of employees for promotion, which is Gloat's core use case; searches restricted to gloat.com for "bias audit" and "Local Law 144" returned nothing.

Have a URL that disputes this?→

No named independent auditor (Warden AI, Holistic AI, BABL AI, DCI, ORCAA, Credo AI, ConductorAI) or academic audit of Gloat's matching models was found via web search or on the ethical AI, security-and-compliance, AI technology or governance-engine pages.

Have a URL that disputes this?→

Gloat's bias-mitigation blog post offers general principles (multi-matching strategies, transparency, treating matches as recommendations rather than final decisions) without disclosing Gloat's own testing methodology, validation results or any third-party review.

https://gloat.com/blog/mitigate-bias/

No EU AI Act Article 27 Fundamental Rights Impact Assessment template, deployer-obligation guidance, or any mention of the EU AI Act was found on gloat.com - checked the page sitemap, security-and-compliance, ethical AI, all four ai-technology pages, the privacy and users-privacy notices, and the responsible-AI blog cluster.

Have a URL that disputes this?→

A Compliance Center portal exists but is a login wall stating only approved users may access it and that new users require administrator approval; it references SOC 2 Type II and ISO 27001 and directs enquiries to a Gloat representative, so no deployer-facing assessment material is publicly obtainable.

https://compliance.gloat.com/

The end-user privacy notice supplies material a deployer could reuse in an impact assessment - disclosure of AI-driven recommendations for jobs, career pathing, skills, learning and mentorship, plus a human-review escalation route - but it is framed as a privacy notice, not an AI Act deployer assessment.

https://gloat.com/users-privacy/

Gloat publishes a concrete AI input exclusion list, stating its "AI does not digest any demographic data or proxies" and naming gender, race, ethnicity, ability, university name and native language among the excluded bias-prone inputs.

https://gloat.com/about-us/gloats-commitment-to-ethical-ai/

Gloat states it holds third-party-verified SOC 2 Type II, ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27018 attestations plus self-assessed GDPR and CSA CAIQ/CCM, with AES-256 at rest, TLS 1.2+ in transit, MFA/SSO/JIT access, monthly vulnerability scans, annual third-party penetration testing and optional regional data residency.

https://gloat.com/security-and-compliance/

A published Technical and Organisational Measures annex documents GDPR Article 32-style controls including encryption, segregation of duties, quarterly access-log reviews, and annual subprocessor risk assessments with review of third-party audit reports - though it contains no AI or automated-decision-making provisions.

https://resources.gloat.com/technical-organisational-measures/

The privacy policy states that personal information "is not used to develop, improve, or train Generative AI and/or ML models" in the website chatbot context, and documents EEA/UK transfer mechanisms (adequacy, SCCs, UK Addendum, US Data Privacy Framework).

https://gloat.com/privacy-policy/

No public subprocessor list, no training-data provenance or dataset documentation, and no published data retention schedule - the security page states the retention policy is available only after an NDA, and the compliance portal holding certifications is login-gated.

Have a URL that disputes this?→

The end-user privacy notice states plainly that "Automated decisions without human involvement are not made on the Platform," that "AI will not automatically apply on behalf of an employee for an opportunity for which it recommended," that "AI insights and recommendations are assistive only," and that employees "may request clarification on AI-based suggestions or ask for human review" via their employer.

https://gloat.com/users-privacy/

The Governance Engine enforces multi-level approval chains with delegation and escalation paths, inherits customer access controls so a manager sees only their team, applies eligibility criteria such as performance thresholds and readiness indicators, and has agents explain why an outcome occurred and what alternatives exist.

https://gloat.com/ai-technology/governance-engine/

Gloat describes a "human-in-the-loop" model as its operating principle and commits to "enhancing - but not replacing - human awareness and decision making," with users able to learn why particular candidates and opportunities were suggested.

https://gloat.com/about-us/gloats-commitment-to-ethical-ai/

No documentation of customer-accessible audit logs of AI recommendations, no per-jurisdiction compliance toggles (e.g. an NYC AEDT or EU high-risk mode), and no published override-and-reason-capture workflow was found; the administrator help center at help.gloat.com redirects to SSO login and is not publicly readable.

Have a URL that disputes this?→

Gloat operates a public system status page showing current operational state and a dated incident history, with subscription via email, SMS, Slack, Microsoft Teams webhook, RSS and Atom.

https://status.gloat.com

The security page discloses an ongoing monitoring cadence - monthly vulnerability scans, annual third-party penetration testing, a CISO-led programme, regularly tested business continuity and disaster recovery plans - and provides privacy@gloat.com for data-subject and support requests.

https://gloat.com/security-and-compliance/

Gloat asserts "proactive monitoring and auditing" including "continuous self-monitoring of models," but publishes no monitoring results, metrics or dashboard against which the claim can be checked.

https://gloat.com/about-us/gloats-commitment-to-ethical-ai/

No coordinated vulnerability disclosure programme, no security.txt (gloat.com/.well-known/security.txt returns HTTP 404), no dedicated security contact address, no public model-update changelog or release notes (help.gloat.com is behind SSO), and no fairness or drift monitoring dashboard.

Have a URL that disputes this?→

A detailed public product page explains matching to internal jobs, projects, mentorships and learning, and describes manager, recruiter and employee-facing surfaces including talent pools, skills gap identification and the Skills Landscape.

https://gloat.com/platform/the-talent-marketplace/

A public security and compliance page consolidates certifications, encryption, access control, data residency and business continuity information and points customers to a Compliance Center for audit reports.

https://gloat.com/security-and-compliance/

Gloat publishes a separate end-user privacy notice aimed at customers' employees that discloses AI-based recommendations and the human-review route - documentation deployers can point their workforce to directly.

https://gloat.com/users-privacy/

Part of a cluster of at least ten responsible-AI blog posts (ethical AI 101, ethical AI checklist, ethical AI mistakes, mitigating bias, representation for ethical AI), though the content is general thought leadership rather than Gloat-specific compliance disclosure.

https://gloat.com/blog/responsible-ai-in-the-workplace/

No publicly available Data Processing Agreement, no NYC Local Law 144 customer guidance, no EU AI Act deployer guidance, and no public product/admin documentation - the help center at help.gloat.com redirects to SSO and gloat.com/guides/ returns HTTP 500.

Have a URL that disputes this?→