On-Device Biometric Boundary
Biometric unlock (FaceID / TouchID) and the 64-bit locality-sensitive hash computation execute strictly inside the candidate's smartphone browser and hardware enclave. Raw face frames never leave local RAM.
Drop-In Webhooks & SAML Inline Hooks · Under 2 Hours to Deploy
Four cryptographic checkpoints across your existing hiring stack.
Manav plugs directly into Greenhouse, Workday, Lever, Bullhorn, SAP Fieldglass, HackerRank, and Okta without altering your candidate UI or storing biometric files. Inspect the exact client/server payloads for all four enterprise hiring workflows below.
01 · Interactive Architecture Explorer
Select a stage to inspect its sequence and cryptographic payload
Every workflow produces a deterministic manav-receipt/2 JSON artifact signed with hybrid Ed25519 + ML-DSA-87 that your ATS, VMS, or SIEM can verify offline against /.well-known/jwks.json.
WORKFLOW 01 · BULLHORN / GREENHOUSE INTAKE
Mutual Employer Proof & Candidate Hardware Anchor
Triggered automatically when a candidate moves to "Recruiter Screen" in Greenhouse or Bullhorn. Before the candidate signs, their phone displays your cryptographically verified Employer/Agency badge (defeating job scams), then mints a non-exportable hardware keypair and on-device 64-bit face hash.
1. ATS fires webhook -> POST /v1/hiring/anchors/challenge
2. Candidate phone verifies Employer Signature + renders FaceID prompt
3. Enclave signs challenge (ES256) + commits 64-bit face hash (manav:human)
4. Signed anchor receipt attached to ATS candidate custom field
2. Candidate phone verifies Employer Signature + renders FaceID prompt
3. Enclave signs challenge (ES256) + commits 64-bit face hash (manav:human)
4. Signed anchor receipt attached to ATS candidate custom field
SECURITY & PRIVACY INVARIANTS
Why This Defeats Proxy Ringers Without Biometric Risk
Because the private key is bound inside the candidate device's Secure Enclave (`ES256`) and paired with an on-device 64-bit locality-sensitive face hash (`manav:human`), neither a remote proxy farm nor a physically mailed burner phone can pass subsequent gates.
0 Bytes PII
Stored in Greenhouse, Bullhorn, or Manav — only the DID public key, 64-bit hash commitment, and RFC 8785 signature
Webhook Request / SDK Invocation
Signed Continuity Webhook Payload
02 · Chief Privacy Officer & DPO Sign-Off
Designed for instant approval by Enterprise Legal & Works Councils
Why global enterprises can deploy Manav across US, EU, UK, and APAC candidate pipelines without triggering biometric data impact assessments (DPIAs).
No Emotion Recognition or Video Scraping
The EU AI Act classifies AI emotion/behavior scoring in recruitment as High-Risk/Prohibited. Manav uses deterministic public-key cryptography and a 64-bit locality-sensitive hash—never opaque behavioral profiling.
Ephemeral Requisition-Scoped Keys
Each candidate anchor is scoped to a single hiring requisition (`req_id`). When the requisition closes or the candidate withdraws, the public key binding can be cryptographically tombstoned with zero residual PII to purge.