An assessment company that gets this wrong does not get a second chance.
Skill testing sits on top of federal employment law. We treat compliance as the product architecture rather than a policy page, because a platform that cannot defend a screening decision is a liability to every employer that uses it.
What we test, and what we refuse to.
The second column is the one that matters. Most of the legal risk in this industry comes from things we have chosen not to build.
- Software and platform proficiency with documented industry use
- Methodology and framework knowledge, such as Lean and Six Sigma
- Job-relevant analysis and reasoning tasks tied to real work products
- Domain knowledge specific to a named occupation
- Regulatory and safety knowledge where the role requires it
Every module must survive a six-step validation process, including a documented job analysis and an adverse impact review, before it goes live to a single candidate.
- Personality profiling. Unvalidated as a job performance predictor
- Cognitive and IQ-adjacent testing. Long history of disparate impact findings
- Physical ability screening. ADA exposure we will not take on
- Credit history. No demonstrated job relevance
- Criminal history as an automatic disqualifier. Ban the Box conflicts
- Culture fit scoring. A proxy for similarity, not competence
- Webcam proctoring. Removed permanently over biometric privacy law
Ten issues we work against, named.
This list came out of a compliance review before a line of assessment code was written. Counsel is engaged before any module goes live, not after.
FCRA classification
Whether a verification report makes us a consumer reporting agency drives disclosure, dispute and adverse action duties. Scoped with counsel before launch.
Title VII disparate impact
Every module is monitored for adverse impact across protected groups. A module that fails review is pulled, not tuned quietly.
ADEA age discrimination
Nothing in the assessment or matching logic uses age, graduation year, or a proxy for either.
ADA accommodations
Four accommodation types are built into the platform architecture before any candidate sits an assessment: extended time, screen reader support, alternate formats, scheduled breaks.
Ban the Box
No criminal history screening at any stage. Employers cannot add it as a filter inside ATLAS.
Employment agency licensing
Matching can trigger state licensure. Reviewed per state before we take candidates there.
Data privacy
CCPA and the Texas Data Privacy and Security Act. Candidates control disclosure of their own scores and can export or delete their record.
Biometric privacy
Illinois BIPA and Texas CUBI. We collect no biometric identifiers of any kind. This is why webcam proctoring is gone permanently.
SOC 2 Type II
Readiness work begins in Phase 1. The audit itself is Phase 2. We will not claim the certification before we hold it.
IP and operating agreement
Founder IP assignment and the operating agreement are executed before any engineering spend. Diligence should never find a gap here.
Six steps before a module reaches a candidate.
This is the process that makes a score defensible in a way an interview impression never is.
Job analysis
Document that the skill is actually required by the occupation, with sources.
Item development
Scenario-based items written against real work products, reviewed by a subject matter expert.
Pilot and item analysis
Difficulty and discrimination statistics on every item. Weak items are cut.
Adverse impact review
Score distributions checked across protected groups by an I/O psychologist.
Benchmark setting
Percentile bands set against the candidate pool, not an arbitrary pass mark.
Ongoing monitoring
Live modules are re-reviewed on a schedule. Drift pulls a module offline.
What investors and enterprise buyers ask first.
Are you a consumer reporting agency under FCRA?
That determination drives a whole compliance regime, so we scoped it with employment counsel before building. Where a report would trigger CRA status, the disclosure, dispute and adverse action workflows are built to match. We would rather carry the obligation knowingly than discover it in litigation.
How do you know your assessments do not discriminate?
We do not simply assert it. Every module goes through documented job analysis, item analysis and an adverse impact review by an industrial and organizational psychologist before launch, and is re-reviewed on a schedule after. A module that shows impact it cannot justify by job relevance gets pulled.
Can an employer auto-reject on a score?
No. A candidate below the benchmark is held with the reason recorded, and a human makes the call. That single design choice is what keeps a screening decision explainable a year later.
Where does candidate data live and who owns it?
The candidate owns their record and controls which employers can see it. Employers own their pipeline data and can export it in full at any time. We do not sell assessment data, and there is no path in the business model where we would.
Do you hold SOC 2 today?
No. Readiness work is in Phase 1 and the Type II audit is Phase 2. We will say we hold it when we hold it. Enterprise buyers who need it before then should talk to us about timing rather than assume.
Bring your hardest diligence question.
We would rather answer it in the first meeting than the fourth. If something here does not hold up, we want to know before you write a check or sign a contract.