Privacy policy

Elsin is made by Surf Platforms Inc., a corporation organized under the laws of the State of Delaware with its principal place of business in San Jose, California. In this policy, “Elsin”, “we” and “us” mean Surf Platforms Inc..

Employers use Elsin to check that the people who apply to them are real and unique, and that the person they interview and hire is the person who applied. Some employers also run their hiring on Elsin: a careers page, applications, a pipeline, interview scheduling, scorecards, messages and offers.

This policy covers:

• Candidates: people who apply to an employer that uses Elsin, or who verify their identity with Elsin.
• Customer users: people at employers (our customers) who use Elsin to hire, including through the API, the command-line tool or an AI agent.
• Referees and other people whose details a candidate or employer gives us, such as a former manager asked to confirm a job.
• Website visitors, including anyone who asks us for a demo.

Elsin is operated from the United States and is intended for employers and candidates in the United States. We do not direct it at the European Economic Area, the United Kingdom or Switzerland: we do not market there and have not established there. Elsin is reachable over the public internet, so if an employer or candidate uses it from elsewhere, the information is processed in the United States. Section 18 sets out the rights we honour if you are in the EEA or the UK.

It does not cover the employer's own handling of your data outside Elsin. Each employer has its own privacy notice, and you should read it when you apply.

Data protection law gives different duties to the organisation that decides why and how data is used (the “controller”, or “business” in California) and to the one that acts on its instructions (the “processor”, or “service provider”).

Our data processing addendum sets out our duties to employers as their processor. If your request is about an application, it is usually quickest to contact the employer. If you contact us, we will pass it to them and help them answer it.

Visit measurement

We use Vercel Web Analytics to count page views. It does not use cookies. Vercel tells visitors apart with a hash made from the incoming request, and discards that hash after 24 hours. For each page view it records the time, the page address and route, the referring page, filtered query parameters, an approximate location (country, region and city), your operating system and browser and their versions, the type of device, and the version of the analytics script.

We use Vercel Speed Insights to measure how fast pages load. It does not use cookies or any identifier. For each measurement it records the route and page address, network speed, browser, device type, operating system, country, the performance measurement and the page element it relates to, details of the measurement library, and the time.

Vercel describes this in its own privacy notes for Web Analytics and Speed Insights. We see these numbers only as totals.

Hosting

Vercel hosts this website. To deliver pages and protect the service, Vercel processes your IP address and the details of each request your browser makes.

Demo requests

If you ask for a demo or to hear about a plan, we store your name, work email, company, the hiring system you use, the plan you are interested in (if you pick one) and your message. We do not store your IP address with the request. We use it to reply and to arrange the demo, and we do not add you to a mailing list. We delete the request automatically after 365 days.

The camera demo

The candidates page has an optional demonstration of the head-turn check. It runs entirely in your browser, using model files served from this website. No image or measurement leaves your device.

• Account: your name, email address and password (stored by our authentication provider as a hash), or a one-time email link, and when you sign in. Your role and which workspaces you belong to, and the email address of anyone you invite. When you sign up, we record that you agreed to the terms of service and this policy and confirmed you are 18 or older, with the versions and the time.
• Shared sign-in: Surf Platforms Inc. runs Elsin and Surf Studio, another of its products, on one sign-in system. If you use both with the same email address, one account serves both, and deleting it removes it from both. Elsin's hiring data is kept apart from Surf Studio's, and a Surf Studio account sees nothing in Elsin unless it belongs to an Elsin workspace.
• Sign in with Surf: if you choose to sign in with a Surf account, Surf sends us your name, email address and profile picture, and an Elsin account with the same email address becomes yours to use with it. We keep no Surf password or Surf access token, and Elsin cannot see or do anything in your Surf account.
• Sign in with Google: if you choose to sign in with Google, Google sends us your name, email address and profile picture, and an Elsin account with the same email address becomes yours to use with it. Google sends only that signed statement of who you are, so Elsin never has any access to your Google account.
• Workspace content: jobs, notes, scorecards, messages, offer letters, settings and anything else you add.
• Billing: if your organisation subscribes to a paid plan, monthly or annually, Stripe collects the payment card, billing name, address and any tax number. We receive and store the Stripe customer and subscription identifiers, the plan, its status and its dates, and the identifiers of the billing events Stripe sends us. We never see or store card numbers. We send Stripe your organisation's name and the email of the person who checks out.
• Connections: when you connect another tool (for example Greenhouse, Ashby, Checkr, Slack or a calendar), the access tokens or keys for it, which we keep in an encrypted secrets store, and your Slack and calendar settings. Calendar connections read free and busy times only, never event titles or details.
• API and AI agent access: API keys and OAuth tokens (we store only a hash of each), OAuth clients you authorise, and a log of every API and MCP call: who made it, with which key or client and agent label, the path, what it touched, the result and when.
• Activity: an audit log of actions in the workspace, and when you last opened the workspace home, so it can show you what is new.
• Notifications: in-app notifications and your email notification preferences. Notification emails carry a one-click unsubscribe.
• Email: we send our own sign-up, sign-in, password and invitation emails, and notification copies, through Resend.

When you apply

• What you send: your name, email, phone number, links, location, headline, résumé and your answers to the employer's questions. We extract the text of your résumé ourselves, without sending it to an outside service.
• Signals from the application, used to spot duplicates, fraud and automated applications: your IP address, browser user agent and language, the device and browser details your browser offers to sites (client hints), time zone, a fingerprint of your device (a one-way code made in your browser from details such as the screen, browser and graphics card; only the code leaves the page), how long the form took to fill in, whether a hidden field that only bots fill in was filled, which notice you were shown on the form and when, and whether the network belongs to a known hosting or VPN range (checked against a list we hold, not an outside service).
• How the form was used, to spot automated applications: counts and timings of pointer, key and paste events (never which keys you pressed), and whether the application declared itself as coming from an AI agent.
• A fingerprint of your résumé: a cryptographic digest and a similarity code, used to spot copies and near copies.
• Where you came from: the job board or link that sent you, if any.
• Profile facts, used as fraud signals: the age and public statistics of a GitHub account you link (from GitHub's public records), the age of the domain in your email address or website (from public domain registries), the country of your phone number, and the timeline of jobs and dates in your résumé.
• Application counts: how many applications the same identity made in a day or a week, across employers. These are worked out when needed and not stored.
• Voluntary equal-opportunity answers: if the employer turns this on, applicants are offered an optional survey about gender, race or ethnicity, veteran status and disability. Every answer defaults to “decline”. Answers are stored apart from your application, nobody reviewing your application can see them, and the employer sees only totals with any group under five people hidden.

At each verification step

When you apply, verify, take the check at interview or on day one, answer a work-history check or give a shipping address, we record the class of network you used (for example home, mobile, or hosting and VPN), your approximate location (country, region, city and time zone), which our hosting provider Vercel works out from your IP address, the browser, operating system and type of device from your user agent, your browser language and the device fingerprint code. We use these to check that the same person, in a consistent place, takes each step.

Your Elsin account

If you sign in to follow your applications or to verify, we hold your email address, name and sign-in details, and the record that you agreed to the terms of service and this policy and confirmed you are 18 or older. Your sign-in is shared with Surf Studio, as section 4 explains.

When you verify your identity

• The result: verified or not, the method used, when it was checked and when it expires.
• About your ID document: its country and type, how it was read (machine-readable zone, barcode, or typed in), and a keyed code made from the number. Never the number itself. In the standard check, never an image of the document.
• About the face check: see section 7.
• Your consent: which notice you agreed to, its version and when, and when you withdraw it.
• If you choose a person to check your ID instead: the photo of your ID that you upload. See section 7.

Later in the process

Depending on what the employer uses, we may also hold:

• Work history checks: the employers, titles and dates you list, a one-time code sent to a work email address (we keep only a keyed code of it and the email domain), the referee you name (their name and email) and their answers, a document such as a pay slip or employment letter for a person to review, and your current address.
• Equipment shipping: if the employer ships you equipment, the name and address you give for it (street, city, region, postcode and country), a keyed code of the address, and whether it looks like a parcel forwarder or an address several new hires share. The address is also included in the new-hire details the employer passes to its HR system.
• Interviews: times, interviewers, video meeting links, interviewers' notes and scorecards. Meeting titles include your name. Elsin does not record or transcribe interviews.
• Messages: emails the employer sends you through Elsin, and status emails such as “application received”.
• Offers: the offer terms, such as salary and equity, and each version of them; the offer letter exactly as shown to you and a SHA-256 digest of it; and, if you sign, your typed name, your drawn signature, the time, your IP address and browser user agent. If you decline, any reason you give.
• Background checks: if the employer uses Checkr, we send Checkr your name, email, phone and work location. Checkr collects the legally required disclosure and your consent itself. We store only the status (for example “clear” or “consider”) and a link, never the report.
• A day-one check: the employer may ask the person starting the job to repeat the face check, to confirm it is the same person. We keep the outcome (matched, inconclusive or not matched).
• Review outcomes: the risk signals found, the overall verdict, and the decisions and notes of the people who review them. If an employer holds an application until the applicant confirms they are a person and you do so with a passkey, we keep only the passkey's credential identifier.

From other sources

If an employer connects Greenhouse, Ashby, Lever or Workable, we import candidates, applications and jobs from it, and can write a verification tag and note back. Employers can also import candidates from a spreadsheet.

If a candidate names you as a referee, we store your name and email address, a keyed code of your email address, its domain, and your answer: whether you confirm the job, your title, the dates, and any note you add. We use your email address only to send you the request, through our email provider Resend. The employer that asked for the check sees your answer. We keep your details with the candidate's record, and they are deleted when the employer deletes that candidate.

The keyed code of your email address is also used, across employers, to count how many other candidates named the same inbox (section 8). That count never reveals who they are.

How the check works

1. Your camera checks that a real person is in front of it, by asking you to turn your head. This runs in your browser. Video frames are processed and dropped as they arrive.
2. You photograph your ID. Your browser reads the document type, country and number from it. The image stays in memory on your device and is dropped.
3. Your browser compares your face with the photo on your ID and works out a single number: how far apart the two faces are. The images and the face measurements used to compare them never leave your device.
4. Your browser turns the ID number into a keyed code. We receive only that code.

The model files that run these steps are downloaded to your browser from public content networks (jsDelivr and Google Cloud Storage). Those networks see your IP address and browser, as with any download. They receive nothing about you or your check.

What we receive and keep

• Whether your face matched your ID (matched, inconclusive or not matched), the match distance (a single number) and the name of the model that produced it.
• For each head turn: which way you turned, how far, how long it took and the brightness of the frame. No image.
• The keyed code of your ID number, and the document's country, type and how it was read.
• Your consent record.

We do not receive or keep a photograph, video, face template, faceprint or face geometry. We treat the match distance and the head-turn measurements as biometric information anyway, because they are derived from your face. Our biometric data policy sets out the full retention and destruction schedule.

Consent

Before the camera starts, we tell you in writing what the check does, what is kept and for how long, and ask you to agree. We record the version of the notice you agreed to and when. A consent counts only for a check started within an hour of giving it.

Who sees it

Employers you share your verification with see whether you are verified, when, the method, and the outcome of the face comparison (matched, inconclusive or not matched). They never see the match distance, your head-turn measurements, your ID number or your face. We never sell, lease or trade biometric information, and we do not profit from it. We disclose it only to the employers you choose, to our sub-processors who store it for us, or where the law requires.

If you would rather not

You can choose to send a photo of your ID for a person to check. A person at each employer you applied to looks at it. A separate copy is kept for each employer and deleted as soon as that employer's reviewer decides. This route uses no face check. If an employer has not reviewed an upload within 30 days, we delete it.

Passkeys

If you add a passkey, we keep its public key, an identifier for it, the authenticator model it reports, whether it is synced or stays on one device, and when you used it. Your face or fingerprint unlocks it on your device and never reaches us. A passkey is optional. We delete it when you remove it, when your verification record is destroyed, or when you delete your account.

How long we keep it, and destruction

We permanently destroy biometric information at the earliest of these times:

• head-turn measurements: within 30 days after the check they were taken for;
• the match distance and your verification record: within 30 days after the verification expires, which is 12 months after it was made;
• everything: when you delete your Elsin account or withdraw consent in your account, and in any case within 30 days after you withdraw consent;
• and in every case, no later than 3 years after your last interaction with Elsin.

To withdraw consent, open Your data in your Elsin account and choose Withdraw and delete. We record the withdrawal and at once destroy your verification record, the match distance, your head-turn measurements and any ID photo still waiting for review. You can also write to contact@surfplatforms.com, and we will do the same within 30 days. Withdrawing does not affect checks already done. Employers then see you as not verified. The outcome of a check an employer already received stays with that employer's record of your application, and a day-one check outcome is deleted no later than 3 years after the check.

To spot the same person, device or document used under different names, or many people using one, we turn certain details into keyed codes: email address, phone number, device fingerprint, IP address, ID number, parts of your résumé, an equipment shipping address and a referee's email address. A keyed code is made with a secret key that only our servers hold, so it cannot be reversed or matched by anyone without that key. Our production systems refuse to run without the key.

When a code has been seen before, the check returns counts only: for example, how many other identities or employers it was seen with, and how many of those were flagged. It never returns a name, a candidate or an employer. Employers see only these counts. They cannot make the codes themselves, because they do not hold the key. When an employer deletes a candidate, that employer's codes for the candidate are deleted too.

We do this to protect employers and genuine candidates from fraud, which is our legitimate interest and theirs (section 11).

Elsin adds up risk signals from an application (for example a reused ID, a device used under many names, or a form filled in inhumanly fast) into a score. A high score sends the application to a person for review. An employer can also choose to hold applications that look automated until the applicant confirms they are a person, for example with a passkey or a quick check.

Elsin never rejects an application by itself. Our database refuses a rejection that does not name the person who made it, and the API and AI agent tools have no way to reject. Decisions an AI agent proposes about verification are, by default, held for a person to confirm.

Because no decision with legal or similarly significant effect is made solely by automated means, the rules on such decisions do not apply to Elsin's scoring. You can still ask the employer for a human review and to explain a decision, and we will help them answer.

When a manager at an employer asks for it, Elsin can write a short summary of a candidate. To do that we send the candidate's name, headline, location, the employer's tags, the jobs applied for, the candidate's answers and the text of their résumé to a large language model hosted for us on Microsoft Azure AI Foundry, in the United States (East US 2). The model is told never to rate the person or mention age, gender, ethnicity, religion, health or family. The summary is kept with the candidate's record. It is not used to score or decide. Summaries are on unless the employer switches them off in its settings; switching them off deletes every saved summary. To control cost we count summaries per person and per workspace, and delete those counts after 2 days.

The model runs in our own Azure resource as a model sold by Azure. Under Microsoft's published terms, prompts and outputs are not available to other customers or to OpenAI, are not used to train or improve models, and the model does not store them. Microsoft screens prompts and outputs for abuse; if that screening flags them, Microsoft may store them, in the same geography as our resource, for review by authorised Microsoft staff. See Microsoft's data, privacy and security terms for Foundry Models sold by Azure and its abuse monitoring page.

Customers can also connect their own AI agents to Elsin through the API or MCP. Those agents act for the customer, within the permissions the customer grants, and the customer is responsible for them.

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases. Where we act for an employer, the employer chooses its own basis.

We do not use personal information for advertising, and we do not build profiles of people for anyone's marketing.

• Employers: your application goes to the employer you applied to. Your verification result goes only to employers you share it with.
• Sub-processors: the companies that host and run Elsin for us (section 13).
• Tools an employer connects: if an employer connects its applicant tracking system, background-check provider, HR system, calendar, video meetings, Slack, Calendly or Cal.com, or sends events to its own web address, Elsin sends that tool the data it needs, on the employer's instructions. For example, Slack can receive a candidate's name, the job and events such as “verified” or “flagged”; BambooHR receives a new hire's name, personal email, mobile phone and start date. Each tool's own terms and privacy notice apply.
• Job boards: receive job listings only, never candidate data.
• Public records: to check a profile, our servers look up a linked GitHub account on GitHub and a domain's age in public domain registries. They receive only the handle or domain, never your name or application.
• Legal and safety: authorities, courts or advisers, where the law requires it or to protect people's rights and safety.
• A change of ownership: if Surf Platforms Inc. is involved in a merger, acquisition or sale of assets, under this policy's protections.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Tools a customer connects (section 12) act on the customer's instructions under the customer's own agreement with them: Greenhouse, Ashby, Lever, Workable, Checkr, BambooHR, Google (Calendar and Meet), Microsoft (Outlook calendar and Teams), Zoom, Slack, Calendly and Cal.com, and the customer's own webhook addresses.

The full list, with the data each one handles, is on our sub-processors page. We update it at least 30 days before a new sub-processor starts handling personal data.

Surf Platforms Inc. and most of our sub-processors are based in the United States, and Vercel serves requests from locations around the world. The Elsin app runs on Vercel in the eastern United States (iad1, Washington, D.C.). Our main database is hosted by Supabase on Amazon Web Services in the United States (us-east-1, N. Virginia).

When we transfer personal data out of the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK Addendum), or another lawful transfer mechanism. You can ask us for a copy of the safeguards.

Employers decide how long they keep their candidates' data, within the tools Elsin gives them. An employer can delete a candidate at any time, in the app, through the API or through an AI agent, and Elsin then deletes everything held about that candidate in that workspace, stored files included. A daily job applies the periods below. Workspace admins can see them in Settings, under Data retention.

Deleted data rolls off our database backups within 7 days, as those backups expire.

• Every table is protected by database rules that let people see only their own organisation's data, and only what their role allows.
• Résumés and ID documents are kept in private storage. Links to them are signed and expire: 30 minutes for a résumé, 2 minutes for an ID document.
• Identifiers used for fraud checks are keyed with a secret that only our servers hold.
• API keys are stored only as a hash, are limited to the scopes and role chosen, expire (after 90 days by default) and are rate limited. Every API and MCP call is logged.
• AI agents connect with OAuth 2.1 and PKCE, with access tokens that last an hour.
• Keys and tokens for connected tools are kept in an encrypted secrets store.
• Review decisions are kept as an append-only record with the name of the person who made them.
• Connections to Elsin and this website use HTTPS.

No system is perfectly secure. If we learn of a breach that affects your personal data, we will tell the employer, you or the authorities as the law requires.

This website

This website does not set cookies or store anything in your browser. Vercel Web Analytics and Speed Insights work without cookies (section 3).

The Elsin app

The Elsin app does not use analytics, advertising or tracking cookies.

In the app

If you have an Elsin account as a candidate, the Your data section lets you:

• Download your data: your account, your candidate profiles, applications and their history, interviews, the text of your résumés, your verification records, consents and check results, the signals recorded from your applications and verification steps, profile facts, work-history checks, equipment shipments, offers with their letters and signatures, and messages.
• Withdraw biometric consent: this destroys your verification record and the data from your face checks at once (section 7).
• Delete your account: this removes your sign-in, your verification results and consent records, any ID photo waiting for review, your agreement records and your notifications. Because the sign-in is shared with Surf Studio (section 4), deleting it also removes it there. Applications you sent stay with the employers who received them, unlinked from your sign-in; ask those employers to erase them. If you belong to an employer's workspace, leave it first.

Customer users can ask a workspace owner for changes to workspace data. Workspace owners can download a full export of their workspace, including its files, and delete the workspace (section 15). Recruiters and admins can delete a single candidate.

Your rights

Depending on where you live, you may have the right to:

• know what we hold about you and get a copy, including in a portable format;
• correct it;
• delete it;
• restrict or object to how we use it, including use based on legitimate interests;
• withdraw consent at any time, without affecting what was done before;
• not be treated differently for using these rights;
• complain to a data protection authority, such as the one where you live or work. In the UK, that is the Information Commissioner's Office.

If you are in the EEA or the UK

Elsin is not currently offered to employers or candidates in the European Economic Area, the United Kingdom or Switzerland, and we have not appointed an Article 27 representative or a Data Protection Officer. The rights above are the ones we would honour, and will honour, under the GDPR and UK GDPR, together with the right to complain to your local supervisory authority. If and when we offer Elsin there, we will appoint and name any legally required representative and Data Protection Officer here.

How to ask

Write to contact@surfplatforms.com. We may need to confirm who you are before we act. You can use an authorised agent; we may ask them for proof that you authorised them. We answer within the time the law sets, usually one month (GDPR and UK GDPR) or 45 days (California). If we decline, we will tell you why and how to appeal.

If your request is about an application, we will pass it to the employer that holds it, because they decide, and help them answer.

In the last 12 months we have collected the categories below, from the sources and for the purposes described in sections 3 to 11, and disclosed them for business purposes to the recipients in sections 12 and 13. We have not sold personal information or shared it for cross-context behavioural advertising, and we do not knowingly sell or share the data of anyone under 16.

We use sensitive personal information only to provide the service you asked for, to verify identity, and to prevent fraud and keep the service secure. We do not use it to infer characteristics about you. We keep each category for the periods in section 15.

Elsin and this website are not meant for children under 16, and we do not knowingly collect their data. Creating an Elsin account requires confirming you are 18 or older, but Elsin does not verify ages, and applying for a job does not need an account. If you believe a child has given us personal information, contact us and we will delete it.

When we change this policy we update the date at the top. If a change is significant, we will tell customers and people with an Elsin account before it takes effect, by email or in the app. If a change affects how we use biometric information, we will ask for your consent again.

Surf Platforms Inc., San Jose, California, United States. Privacy questions and requests: contact@surfplatforms.com.

We have not appointed a Data Protection Officer or an EU or UK representative, because Elsin is not offered in those places yet (section 18).

For general questions, use contact@surfplatforms.com. The terms of service and the end user licence agreement explain the rules for using Elsin. Employers can also read our data processing addendum, sub-processors and biometric data policy.