hackajob
HireAIScore rates hackajob 45 out of 100 (grade F, Substantial gaps) under rubric v1.0, last reviewed September 25, 2026. hackajob ranks 47 of 86 vendors rated in Candidate sourcing AI, against a category average of 46. That score is drawn from 42 evidence items across 7 rubric criteria for hackajob — 38 with a cited source, 4 recording that nothing was located.
Score breakdown
hackajob, criterion by criterion
Each rubric criterion is scored out of 100 on the cited evidence, then weighted into the total.
Weighted contribution shown to the right of each bar.
Article 11 Technical Documentation
Weight 20% · category avg 48
60
+12.0
Bias Audit Transparency
Weight 18% · category avg 40
20
+3.6
FRIA Support
Weight 15% · category avg 31
32
+4.8
Data Governance Disclosure
Weight 15% · category avg 53
58
+8.7
Human Oversight Design
Weight 12% · category avg 56
55
+6.6
Post-Market Monitoring
Weight 12% · category avg 40
38
+4.6
Customer Documentation
Weight 8% · category avg 57
60
+4.8
Total weighted score
45.1(rounded to 45 for display)
Category avg is the mean raw score on that criterion across the 86 Candidate sourcing AI vendors in scope of this rubric, this one included.
Strongest criterion
Customer Documentation
60raw / 100
Contributes 4.8 to the total. 60 against a 57 category average.
Weakest criterion
Bias Audit Transparency
20raw / 100
Contributes 3.6 to the total. 20 against a 40 category average.
Cited evidence
The evidence behind the score
Every score is backed by at least one cited piece of evidence. Open a criterion to see what was found, when, and where.
Download diligence recordEvidence ledger
- Items
- 42
- Documentation
- 26
- Public statement
- 12
- Absence
- 4
- With a source URL
- 38 of 42
- Source hostnames
- 4
- Fewest items
- 5
- Bias Audit Transparency
These figures measure how thoroughly hackajob was reviewed, not how hackajob performed — an absence row, recording that nothing was located, is counted like any other item.
Article 11 Technical Documentation
6 items60
- DocumentationCaptured Sep 25, 2026
hackajob's Sprinto trust centre shows ISO 42001 v2023 as 'Certified' (labelled 'AI certification') alongside ISO 27001 and SOC 2, but the certificate is gated and the certification body is not named publicly.
- DocumentationCaptured Sep 25, 2026
The trust centre lists 'Archer - Use of AI' and an 'AI Explainability Guide' (both files dated September 2026), but all 24 listed resources sit behind 'Request access', and none of the 17 listed policies is an AI policy.
- DocumentationCaptured Sep 25, 2026
The privacy policy's AI section says Archer's assessment decides which opportunities are surfaced, promises candidates a plain-language account of the factors considered, and states that hackajob's AI governance is certified to ISO/IEC 42001:2023.
- Public statementCaptured Sep 25, 2026
The Head of Product's December 2025 post describes an Experiment, Early Release, General Release lifecycle and internal rules for AI agents, including 'adaptive screening agents', but gives no system-level documentation.
- Public statementCaptured Sep 25, 2026
hackajob marketed Chase as an AI recruiter 'holding tens of thousands of conversations weekly' but publishes no documentation of what these conversational agents ask, assess or record.
https://hackajob.com/employer/blog/ai-is-transforming-hiring
- AbsenceCaptured Sep 25, 2026
No public model card, instructions for use or technical description of Archer's qualification model or the voice agents was found on hackajob.com (full sitemap), the candidate help centre, the employer terms, the DPA or the public sections of the trust centre.
Bias Audit Transparency
5 items20
- AbsenceCaptured Sep 25, 2026
No NYC LL 144 bias audit summary, impact-ratio table or independent audit of Archer, Thena or the voice agents was found across hackajob.com (75 employer blog posts plus product, legal and help pages), the DPA or the trust centre's 24 resources, and trust.warden-ai.com/hackajob returns 404.
- DocumentationCaptured Sep 25, 2026
The Thena Product Terms say hackajob 'continually evaluates model performance for fairness, accuracy, and bias, consistent with standards such as ISO 42001', but no results are published and the terms disclaim any warranty that outputs are free from bias.
- Public statementCaptured Sep 25, 2026
A February 2025 hackajob post says its machine learning improves 'forecasts of applicant success by learning from past recruitment data' and 'mitigates biases', without citing any audit or test.
- Public statementCaptured Sep 25, 2026
hackajob reports internal tests showing that hidden text and prompt injection in CVs did not affect its LLM agents, which is robustness testing rather than a demographic bias audit.
https://hackajob.com/employer/blog/whitefonting-in-cvs-what-it-is-why-people-do-it
- DocumentationCaptured Sep 25, 2026
The privacy policy says special-category data that candidates volunteer is never used as a matching or ranking signal, which excludes an input but does not test outcomes by group.
FRIA Support
5 items32
- DocumentationCaptured Sep 25, 2026
The employer terms assign controller and processor roles through a DPA and product terms but never mention the EU AI Act, deployer obligations or impact assessments.
- DocumentationCaptured Sep 25, 2026
The public DPA commits hackajob, as Thena's processor, to help clients with GDPR Articles 32 to 36 including DPIAs, but says nothing about the EU AI Act or fundamental-rights assessments.
- DocumentationCaptured Sep 25, 2026
A gated trust package (Archer - Use of AI, AI Explainability Guide, SOC 2 Type 2 report, pentest summary and 17 policies) is available only on request and is not presented as deployer or FRIA guidance.
- DocumentationCaptured Sep 25, 2026
The Thena terms make the client the data controller, responsible for lawful grounds, notices and the use of Thena's scores and rankings, which assigns some deployer duties without any AI Act guidance.
- Public statementCaptured Sep 25, 2026
hackajob tells buyers 'Your legal team has no algorithmic decisioning to review', which discourages the deployer-side assessment that high-risk recruitment AI calls for.
Data Governance Disclosure
8 items58
- DocumentationCaptured Sep 25, 2026
The public subprocessor list names 41 vendors with their locations and flags nine as AI subprocessors, including OpenAI, Google Gemini, Claude, Azure OpenAI, Cohere (as a 'Ranking & Scoring Platform') and the voice providers VAPI, LiveKit, ElevenLabs and Deepgram.
- DocumentationCaptured Sep 25, 2026
The privacy policy lists data categories and sources, including job boards, social networks and 'identity and contact data brokers and aggregators', states that data is stored in the EEA with SCC and IDTA transfer safeguards, and bars special-category data from matching and ranking.
- DocumentationCaptured Sep 25, 2026
The public 41-page DPA lists the candidate fields shared with clients, and names health data, gender, ethnicity, neurodiversity and sexual orientation found in CVs as sensitive data subject to safeguards.
- DocumentationCaptured Sep 25, 2026
The trust centre shows ISO 27001 and ISO 42001 as certified and SOC 2 as compliant, with a 2026 SOC 2 Type II report available only on request, although marketing pages still say 'SOC 2 Type 1'.
- Public statementCaptured Sep 25, 2026
The product page says Archer indexes '800m+ profiles ... across GitHub, LinkedIn and dozens of professional platforms' but does not explain how those profiles are collected or processed before a person opts in.
- Public statementCaptured Sep 25, 2026
The CEO's February 2026 post says Archer uses 'First-party, consented data only' and 'works exclusively with candidates who have opted in', a claim that is hard to reconcile with the 800m+ indexed-profile figure.
- DocumentationCaptured Sep 25, 2026
The help centre says identity checks use Veriff (a selfie plus a photo of ID), but Veriff does not appear in the trust centre's 41-entry subprocessor list and the privacy policy does not mention biometric checks.
https://help.hackajob.com/talent/understanding-identity-verification-on-hackajob
- Public statementCaptured Sep 25, 2026
A November 2025 post says voice technology surfaces candidates' 'tone, clarity, reasoning, curiosity' before a recruiter sees a CV, yet no policy says which voice signals feed qualification or how call recordings are kept.
https://hackajob.com/employer/blog/how-conversational-ai-is-transforming-hiring-conversations
Human Oversight Design
6 items55
- Public statementCaptured Sep 25, 2026
The Archer FAQ says 'Archer makes no algorithmic decisioning about candidates: every candidate chooses to apply themselves', while the same page says Archer 'qualifies them against your bar, and invites the right ones to apply'.
- DocumentationCaptured Sep 25, 2026
hackajob's May 2026 AI sourcing guide defines pre-apply qualification as assessing fit before anyone applies and says Archer 'only invites those who meet the bar', which is an automated gate on who reaches the recruiter.
- DocumentationCaptured Sep 25, 2026
The privacy policy says Archer's AI-generated assessment decides 'which opportunities to surface' and lets candidates ask why they were not shown a role (reply within 10 business days) and request human review, but warns that objecting to the algorithms ends the service.
- DocumentationCaptured Sep 25, 2026
The candidate guide says people can apply only to roles Archer matches them to, 'by design', so the matching step controls access to roles through this channel.
https://hackajob.com/talent/job-search-guide/what-is-hackajob
- DocumentationCaptured Sep 25, 2026
Candidates see an in-product breakdown for each match showing which requirements they meet, which experience is relevant and why they fit.
- Public statementCaptured Sep 25, 2026
hackajob's stated rules let AI 'summarise, assess, and shortlist' while humans approve decisions, which describes AI shortlisting rather than the absence of algorithmic decisions.
Post-Market Monitoring
5 items38
- DocumentationCaptured Sep 25, 2026
An Atlassian Statuspage not linked from hackajob.com tracks eight platform and email components, none of which covers Archer, the AI agents or the voice agents.
- DocumentationCaptured Sep 25, 2026
The status feed lists 19 incidents between August 2019 and March 2026 with timestamped updates but no postmortems.
- DocumentationCaptured Sep 25, 2026
The trust centre publishes 54 security controls, including incident-reporting information for customers and anomaly detection, none of which addresses AI model performance, drift or bias.
- Public statementCaptured Sep 25, 2026
The privacy policy says hackajob's AI systems are 'designed, monitored, and reviewed by our team on an ongoing basis' and gives a DPO contact, without describing metrics or reporting.
- AbsenceCaptured Sep 25, 2026
No security.txt (hackajob.com/.well-known/security.txt redirects to a not-found page), vulnerability disclosure policy, AI incident channel or model and prompt changelog was found.
Customer Documentation
7 items60
- DocumentationCaptured Sep 25, 2026
The Archer product page carries a 12-question FAQ covering sourcing, matching, ATS delivery, EU AI Act status, GDPR and CCPA handling, and pricing.
- DocumentationCaptured Sep 25, 2026
A public 41-page DPA covers controller and processor roles, transfer clauses and security measures, plus a Thena schedule describing screening, filtering and ranking of applicants.
- DocumentationCaptured Sep 25, 2026
The public Thena Product Terms set out data roles, client responsibility for scores and rankings, notice of subprocessor changes and an AI transparency clause.
- DocumentationCaptured Sep 25, 2026
The candidate help centre lists the factors Archer weighs: career history, transferable skills, salary expectations, location, right to work and clearances, and employer requirements.
https://help.hackajob.com/talent/how-does-hackajob-partner-with-employers
- DocumentationCaptured Sep 25, 2026
A plain-English guide explains what the matching reads and cannot do, and says each match shows which skills lined up, where the gaps are and why Archer rated the candidate a fit.
https://hackajob.com/talent/job-search-guide/how-ai-job-matching-works
- Public statementCaptured Sep 25, 2026
The April 2026 Workday partnership post tells buyers Archer is 'EU AI Act compliant' with 'No algorithmic decisioning for legal to review', which could lead deployers to under-assess their own duties.
https://hackajob.com/employer/blog/hackajob-is-now-a-workday-innovation-partner
- AbsenceCaptured Sep 25, 2026
No NYC LL 144, Illinois, Colorado or California guidance for employers, no EU AI Act deployer guidance and no public employer help centre (help.hackajob.com/employer returns 404) were found.
Editorial notes
Company overview
hackajob Ltd is a London hiring marketplace founded in 2014 by Mark Chaffey and Razvan Creanga. It has offices in New York, Iasi, Medellín and Bengaluru and has raised about $42m, including a $25m Series B led by Volition Capital in 2023. In September 2026 it rebuilt the business around Archer, an AI agent it launched in 2025. A recruiter calibrates Archer on a hiring brief. Archer then finds, engages and qualifies passive candidates from 1.5m vetted members and 800m+ indexed profiles, and invites those who clear the bar to apply into the client's ATS (Workday, Greenhouse, Lever and others). hackajob has also sold Chase, an AI recruiter it said held tens of thousands of conversations a week, and Thena, a CV screening and ranking tool. It lists VAPI, LiveKit, ElevenLabs and Deepgram among its AI subprocessors as voice and speech providers.
Regulatory exposure
Archer's pre-apply qualification evaluates candidates against a brief and decides who is invited to apply. That fits EU AI Act Annex III point 4(a). Because Archer appears to profile people on experience and behavioural signals, the Article 6(3) exemption is likely unavailable. So hackajob's line that Archer makes 'no algorithmic decisioning' does not take it out of the high-risk category, whose obligations now apply from 2 December 2027. hackajob also calls Archer 'compliant with the EU AI Act' without publishing documentation to support it. The voice agents need checking against the Article 5(1)(f) ban on workplace emotion recognition, because a hackajob post says voice surfaces candidates' 'tone, clarity, reasoning, curiosity'. Under UK and EU GDPR, the privacy policy says hackajob's AI has no 'legal or similarly significant effects', yet GDPR Recital 71 gives e-recruiting without human intervention as an example of such an effect. NYC Local Law 144's rules cover people who have applied, so pre-application sourcing may fall outside it. Thena, which filters and ranks applicants, is the kind of tool NYC employers may use only after an independent bias audit. hackajob has a New York office and publishes no such audit, and DCWP has promised tougher enforcement. Illinois HB 3773 (since 1 January 2026) covers AI used in recruitment and requires notice. Colorado's SB 26-189 disclosure duties start on 1 January 2027, and California's FEHA rules require employers to keep automated-decision records for four years.
Path to a higher score
The biggest gain would be an independent bias audit of Archer's qualification step and of Thena, with impact ratios by sex, race/ethnicity and their intersections published in LL 144 format and repeated every year. hackajob already collects special-category data that candidates volunteer, so the analysis is possible. Next, publish public versions of the gated 'Archer - Use of AI' and 'AI Explainability Guide' and name the ISO 42001 certification body and scope. Add instructions for use and deployer guidance covering EU AI Act Article 26 duties, FRIA support for public-sector clients, and NYC, Illinois, Colorado and California notices. Describe the qualification gate plainly instead of as 'no algorithmic decisioning'. Several statements contradict each other: the candidate terms' 'no profiling' line, SOC 2 'Type 1' on marketing pages against a Type II report, and 'consented data only' against 800m+ indexed profiles. The Veriff ID checks are also missing from the subprocessor list, and the DPA links to a subprocessor list that requires sign-in. Finally, document what the voice agents assess, record and keep, add Archer and voice components to the status page, and publish a security.txt, an AI incident channel and a model changelog.
Regulatory frame
What applies to candidate sourcing AI.
Ranking outputs are inside Annex III §4 when they influence hiring decisions. GDPR Article 22 (automated decision-making) and the GDPR rights around profiling apply independently for EU candidates.
Compare
hackajob against its nearest-scoring peers.
The closest scores in Candidate sourcing AI, side by side.
- Side-by-sidehackajob vs JobAdder45F
- Side-by-sidehackajob vs Jobvite45F
- Side-by-sidehackajob vs Dover45F
- Side-by-sidehackajob vs Avionté45F
Ranking
Others rated in Candidate sourcing AI
Ranked 47 of 86 by weighted total under rubric v1.0. The ordering is arithmetic on the rubric and carries no view on which tool suits a given hiring process.
- #44JobAdder45F
- #45Jobvite45F
- #46Dover45F
- #47hackajobThis profile45F
- #48Avionté45F
- #49Cegid45F
Conflicts of interest
No vendor pays for placement, scoring, or removal. Casework - the consulting firm that operates this directory - provides paid services to some vendors. Any active or recent (within 24 months) commercial relationship is disclosed on the affected vendor profile and the review is reassigned to an independent reviewer. See the full policy on About.
Casework has no commercial relationship with this vendor.