The compliance matrix, walked posture by posture

SOC 2 readiness is under way with continuous control monitoring. A Type I report is the first deliverable. No Type II report is claimed until one has been issued, and the report date will be published when there is one. A readiness programme is a real thing with real work in it, and it is not a certification. Any vendor page that lets those two blur together is doing so deliberately.

WCAG 2.1 AA is the accessibility target. Candidate-facing surfaces are built to it and audited before each release, and findings and their status are published on the trust page. Conformance is described as a programme rather than a finished state, because every release changes the surface and a one-time claim of full conformance ages badly.

What in progress gives a buyer is a straight answer to the question a security reviewer actually asks: is there a report, and if not, is there a programme with a first deliverable named. Yes to the second, not yet to the first, is a usable answer. A logo implying the first is not.

For UK and EU GDPR the product supports consent capture on candidate records, configurable retention windows, data export and erasure workflows. You remain the controller for the candidate data you hold, which means the lawful basis, the retention decision and the answer to a data subject are yours. The product makes the controller's job possible; it does not perform the role.

CCPA and CPRA sit the same way: the product supports consumer access, deletion and opt-out request handling against candidate records held in your tenant. India's DPDP Act likewise supports notice and consent records against candidate profiles, and portability export. In each case the tooling is real and the obligation is yours.

NYC Local Law 144 is the sharpest example of a genuine split. Where an automated employment decision tool is in scope, the product records which candidates were scored and exports the data an independent bias audit needs. Commissioning that audit and issuing candidate notice remain yours. Nobody can commission your audit for you, and a vendor claiming to have handled that obligation has misunderstood it.

For TCPA and CAN-SPAM the product supports opt-in capture, STOP and unsubscribe keyword handling, suppression lists and a physical postal address in email footers. Whether a given campaign is lawful depends on how you configure and send it. That sentence is the whole posture in one line, and it is the honest one.

Call recording consent is handled by restricting recording and transcription by jurisdiction, playing a spoken disclosure before recording begins, and applying per-tenant retention limits. All-party-consent states are handled by disabling recording rather than by assuming consent, which is the conservative default and occasionally an inconvenient one.

EEOC and OFCCP reporting is supported by storing demographic data separately from the hiring record, keeping it invisible to recruiters, and using a fixed disposition code list rather than free text so an audit trail can reconstruct the decision. Pay transparency is supported by checking a posting against the salary-range disclosure rules of the states and countries it is published to and flagging it before it goes out. Right to Work, I-9 and Working Rights are supported by document capture and expiry reminders; the verification itself is a workflow you run, not a certification we hold.

SMS sending in the United States requires your own brand and campaign registration with the carriers. The product provides the fields and the sending integration; the registration is yours. There is no way for a software vendor to hold that registration on your behalf, and a vendor that implies it can is describing something the carriers do not permit.

The same logic runs through the other customer-held items even where they are not separate rows: your WhatsApp Business number and its template approvals, your job board contracts and their terms of use, your background-check vendor relationships and the adverse-action process that goes with them, and your client contracts and whatever they flow down to you.

Naming this category explicitly is the point of the matrix. A buyer who assumes the platform covers registration discovers otherwise when a campaign is blocked, usually on the day it mattered. Reading the customer-responsibility row before signing is considerably cheaper than reading it afterwards.

Staffing firms increasingly get audited by their own clients, and the questions arrive as a spreadsheet. The efficient move is to answer each line with the posture and the capability rather than with a yes. Yes invites a follow-up. Supported in product, with these controls, and this part sits with us as the employer or the agency, closes the line.

Where a row says shared responsibility, your answer needs to describe your half. What lawful basis do you rely on, what retention window did you set, who answers a data subject request, who commissions a bias audit if one is in scope. Those answers do not come from the vendor and a reviewer will notice if you try to source them from one.

The documents to have alongside this page are the data processing addendum, the subprocessor register with its version date, the security overview and, when issued, the SOC 2 report. Those four cover most of what a reviewer asks for, and knowing which one answers which question saves a week.

No page on this site states that Surhires or Soor LLC is compliant with, or certified against, a statute or framework. Not GDPR compliant, not TCPA compliant, not SOC 2 certified. Those phrases are common in recruitment software marketing and they are wrong in a specific way: compliance attaches to a processing operation and a controller, not to a piece of software sitting on a shelf.

Criminal and regulatory statutes are also never described as certifications. There is no such thing as being certified against the TCPA. A product can support the controls a sender needs; whether the sender is lawful depends on consent, registration, content and timing, all of which the sender controls.

The reason for holding this line even where it costs a sentence of marketing polish is that the buyers who care are precisely the buyers worth having. A procurement reviewer who has seen a hundred vendor claims can tell the difference between a capability statement and a badge, and treats the vendor accordingly.