OBSCURA for HR and recruiting
HR holds the most personal files in most organisations: CVs, payroll exports, grievance notes, the replies to a subject access request. The tools here work on those files in the browser, so a CV is blinded, a spreadsheet checked and a request answered without the material going to another service.
The applications for HR work
The single tools further down each do one job on one file. These four are applications, for the requests, surveys and investigations that run for weeks. Each is paid for, on its own or with the rest of Pro, and each keeps its work in the browser on the computer it runs on.
OBSCURA Case
For a subject access request or a grievance that runs to a mailbox. The exported mail (Outlook PST, MSG, EML or MBOX) and the shared documents are loaded on the adviser’s laptop, duplicates and quoted replies set aside, and searched for the person’s name in its forms with Boolean and proximity terms. Colleagues’ details are redacted, each with its reason, and the disclosure is produced as numbered pages with a log of what went out.
Search finds what it is asked for: a nickname nobody thought to search will be missed. One browser holds a case, so a second reviewer works in a copy that is merged back.
OBSCURA Research
For a staff survey or a set of exit interviews: the ratings tested properly, with the tables a report needs, and the open answers and transcripts coded by theme. Its anonymiser replaces each name in a transcript with the same pseudonym everywhere and gives you the key file to keep apart.
In a small team a department and a length of service can identify somebody without a name. Check the results with CROWD before they are shared.
OBSCURA PDF Studio
A batch of documents for a request searched for email addresses, telephone and National Insurance numbers and the names you list; each match ticked or left, and the words under it taken out of the file. Bates numbers and a footer on every file in the set, and scanned letters made searchable first.
A pattern misses a number written in an unusual way or split across two lines; read the list of matches before you redact.
OBSCURA Keep
An HR adviser’s own logins and two-step codes for the payroll, pension and HR systems, encrypted on their own device with Argon2id and AES-256-GCM.
Keep belongs to one person. It is not a store for employee files, and there is no shared team vault.
Where HR work goes wrong with files
Names in capitals are single tools: free to open and to check a file with, and Pro to save the result. A name marked Pro is a service inside the Sovereign Suite, which is Pro as a whole.
Shortlisting with the name still on the CV
A name, a photograph, a graduation year and a postcode all reach the reader before the experience does.
- BLIND: strips names, contact details, dates, schools and other identity markers from a batch of CVs (.docx, PDF or text) and returns packets labelled Candidate #1, #2, with a key kept by whoever runs the process
- INTERVIEW: the questions as the structure, timed notes against each, and a record laid out to be read back
Read first: whether it is safe to upload a CV.
Subject access requests
The clock starts the day the request arrives, whoever it reached and whether or not anybody recognised it as one.
- DSAR: counts the deadline, records what was searched and what was withheld and why, and drafts the reply; built around the GDPR and UK GDPR, with other periods selectable
- SEAL: redacts other people’s details from a PDF so the text is gone, not covered
- REDACTLOG: the schedule of each redaction and the ground for it
- DOCKET: lists every file being disclosed, with its SHA-256
Personal data in spreadsheets
An export is easier than a query, so it goes out with three more columns than anybody meant, a hidden sheet, or the whole source table cached inside a pivot.
- DATASCAN: finds the columns in a CSV or JSON file that hold emails, phone numbers, national identifiers, card numbers and addresses; names and free text have no shape and are not found
- CLEANSHEET: removes hidden and very hidden sheets, pivot caches, formulas, external links and comments from an .xlsx
- ANON: replaces names with codes from a keyed hash, the same code for the same person across every file
- CROWD: checks whether people can still be picked out of a dataset once the names are gone
Read first: what a spreadsheet hides and anonymising names in a spreadsheet.
Investigations and difficult conversations
The record made at the time is the one that is believed later.
The records the law asks for
Registers that are usually a spreadsheet nobody opens until someone asks for them.
- ROPA: the Article 30 record of processing activities, checked for gaps
- RETENTION: what is kept, why and for how long, and what is already past its date
- CONSENT: who agreed to what, when and to which wording, and every withdrawal
- BREACH: the form, the clock and the notification when something goes to the wrong person
Rotas, leave and hours
The arithmetic a spreadsheet does not check.
Sending an offer, a settlement or a file of records
The document is personal to one person, and an ordinary attachment is readable wherever it lands.
- Send a file securelyPro: files sealed into one page that opens with a passphrase sent another way
- PADLOCK: an AES-256 password on a PDF
- MERGE: one letter per row from a template and a list, as a PDF of every letter
Why it matters that the file stays on the machine
Candidates and employees did not choose the tools HR uses on their data. Each web service a CV or an export passes through is another organisation holding it, with its own terms, its own retention and its own risk of a breach, and usually another entry to make in the records HR already keeps.
A tool that never receives the file is not one of them. Here it is read from the disk and worked on in the tab, and nothing is uploaded; that holds for a mailbox loaded into Case and a survey opened in Research as much as for a single CV. You can watch the network tab to confirm it, or follow the tests on the verification page. Nothing about an employee goes to us, so there is no new processor to add to the record of processing for the files.
It does not take away the organisation’s own obligations: a lawful basis for holding the data, how long it is kept, the security of the laptop it sits on, and the reply to the person who asked. Those stay with you.
A worked example: a subject access request
A former employee asks for everything held about them. On the HR adviser’s laptop:
- DSAR logs the request with the day it arrived, and the deadline is counted from then.
- The HR system’s export goes through DATASCAN, which shows which columns hold personal data, and CLEANSHEET, which finds a hidden sheet of salary history for the whole team. Only this person’s rows go into the reply.
- Emails that name colleagues are exported to PDF and go through SEAL, which removes the colleagues’ names for good. REDACTLOG records each redaction and why.
- X-RAY checks the finished files for anything left under a box or in the document properties.
- DSAR drafts the reply, and the files go through Send a file securely, with the passphrase given over the phone.
What it costs an HR team
Every tool above is free to open and to check a file with. Saving the blinded CVs, the cleaned spreadsheet or the redacted PDF is Pro.
- Free, for everyone
- The Workspace: Docs, Sheets, Slides, Notes, Calendar, Tasks, Contacts, Plan, Drive and the PDF editor, at work as well as at home. And every single tool on this page, to open a file and see what it finds, with no account.
- One application, for one person
- US$4 a month or US$35 a year, with 7 days free: Case, Research, PDF Studio or Keep on its own, whichever the team works in.
- Pro, for one person
- US$9 a month or US$79 a year, with 7 days free. Every application, and saving the result in every tool outside the Workspace.
- More than one person
- For now each person needs a plan of their own: a key is for one person, on every browser they use. Plans for a team or a business are not offered at the moment. A team that already has one keeps it, and whoever holds its key goes on adding people and taking them off at /seats.
- Not included
- No admin console, single sign-on, audit log or shared team storage: each person’s work stays on their own machine. The page for teams lists the rest, with the answers a security reviewer will ask for.
Checkout is Stripe’s: the card is asked for at the start and not charged until the seven days are over, and if you cancel before then nothing is paid.
Questions
Does blind review remove bias?
It reduces the effect of names and backgrounds on a first read. It does not fix bias on its own, because the interview still happens. BLIND says the same on its own page.
Does DATASCAN find names?
No. It finds values with a shape: email addresses, phone numbers, national identifiers, card numbers that pass the Luhn check, IBANs, IP addresses, dates of birth and postal addresses. A column of names or of free-text notes looks like ordinary words, and is often the most sensitive thing in the file, so read those yourself.
Where are the registers kept?
In the browser on the machine where they were made. DSAR, ROPA, CONSENT and the other registers are private to that browser, not shared across the team, and clearing the browser’s site data removes them. Save the export each tool offers and keep it where your records live.
Is DSAR only for the GDPR?
It is built around the GDPR and UK GDPR: a calendar month, the extension for a complex request, and when the clock can pause. The deadline can also be set to 30 days, 45 days or any number, for other regimes. It does not tell you which rule applies.
Can the whole team use one subscription?
Not for now. Each person needs a plan of their own: a key is for one person, on every browser they use, added under Sign in on the Pro page. A team that already has a Team or Business plan keeps it and adds people at /seats.
Guides for this work
Questions this work runs into, each answered in full and ending at the tool that does the job.
- Is it safe to upload your CV?: What to leave off, what a Word CV says about its author, and the hidden-text problem, including the copy you did not put there.
- How to anonymise names in a spreadsheet, and keep the same person the same: Find and Replace is not consistent across a second file and a lookup table is the re-identification key written down.
- Data still in a spreadsheet you deleted: An .xlsx is a zip archive of XML parts, and deleting something from the grid changes one part and leaves the rest.
- Is it safe to upload your payslip?: Everything written about payslips and privacy is about whether a company may email them to staff.
- Checking a rota: rest, runs and the rolling week: A late then an early is nine hours and looks fine in a grid. Why a calendar week hides the worst fortnight in most rotas ever written.
The same tools, for other work
This page describes what the tools do. It is not legal or employment advice, and nothing on it says that using them meets any data protection requirement.