Trust centre
Taali makes decisions about people’s careers. This page states how those decisions are made, what a person can do about one, where the data sits, and which obligations apply to us — in enough detail to be checked rather than believed.
How decisions get made
Taali scores candidates against criteria your team writes and can read. Every score cites the verbatim CV evidence it rests on, and every verdict names the rule that produced it — there is no opaque model score you are asked to take on trust.
Advancing a candidate is always queued for a person to approve. Rejection at the pre-screen stage can be automatic: where a candidate does not meet the screening rules your recruiter wrote, or scores below the pre-screen threshold, the rejection applies without a human step. That behaviour is on by default and the hiring organisation can turn it off for any role.
Anyone affected by an automated decision can ask for human review. Where Taali sends the hiring organisation’s emails to candidates, the rejection email says the decision was automatic and links to a page where the candidate can ask a person to review it. Otherwise, contact the organisation that advertised the role, or write to us and we will route it to them as the controller.
What human review actually means here
Regulators are explicit that human involvement cannot be a rubber stamp — the reviewer needs authority to change the outcome and access to the evidence behind it. Taali is built for that: the reviewer sees the score, the citations, the rule path and the criteria version the decision was made under, and can override any verdict.
Every override is recorded. Criteria changes, threshold moves and decision-policy revisions are written to an append-only history per role, so what the bar was on any given day is a matter of record rather than recollection.
Where data lives, and who touches it
Taali runs on US infrastructure, in one deployment that every customer shares. Taali is established in the Dubai International Financial Centre, and the Taali staff who operate and support the service access data from the United Arab Emirates. For customers in the UK and EU that makes every candidate record a restricted international transfer. The transfer to Taali rests on Standard Contractual Clauses with the UK Addendum in our Data Processing Agreement; onward transfers rest on the EU–US Data Privacy Framework where a subprocessor is certified, and on Standard Contractual Clauses where one is not.
AI analysis runs on Anthropic’s models under Anthropic’s global routing by default. A customer can ask for its organisation to be limited to US-only processing; some features aren’t available under that limit yet.
For candidate data your organisation is the controller and Taali is the processor, acting on your instructions. Taali is a controller only for its own account, billing and usage data, and for aggregate hiring statistics it may publish, which an organisation can ask to be left out of.
See every subprocessor and its transfer mechanism
Regulatory position
Recruitment AI is Annex III high-risk under the EU AI Act, and Taali is the provider of such a system. Following the Digital Omnibus, those obligations apply from 2 December 2027. The Act’s transparency duty — telling people they are interacting with an AI system — has applied since 2 August 2026. Taali’s own candidate-facing pages and emails say when AI is involved; where a customer’s own applicant tracking system contacts candidates, that notice is the customer’s to give.
In the UK, the DUAA reforms to automated decision-making (Articles 22A–22D) have been in force since 5 February 2026. They permit solely automated significant decisions subject to safeguards: information about the decision, the ability to make representations, human intervention, and a route to contest.
We describe this as preparation, not certification. Taali logs every decision and gives reviewers the controls to oversee and override it. The rest of a provider’s obligations — a risk-management system, technical documentation, instructions for use, a quality management system, conformity assessment and registration — are not in place yet, and we don’t yet measure how often reviewers override decisions. Taali holds no AI Act conformity assessment.
How long data is kept
The hiring organisation decides how long candidate data is kept. Its owner can set a period of 30 to 3,650 days, after which Taali automatically erases unsuccessful candidates — those whose applications were all rejected or withdrawn. Automatic erasure is off until the organisation sets a period; Taali sets no default.
An erasure removes the candidate’s applications, CV, assessments, interview and voice transcripts, notes, equal-opportunities answers and shared reports along with the candidate record, and the stored files shortly after.
Decision and audit history is deliberately kept beyond the candidate record: it is the evidence that a decision was made properly, and destroying it would remove the ability to answer for it.
Contesting a decision
A candidate rejected automatically can use the review link in Taali’s rejection email, where Taali sends the hiring organisation’s emails. The organisation’s owner records whether the decision stands or is overturned, and an overturned rejection reopens the application and can’t be applied automatically again.
Any candidate who wants a decision reviewed can also go to the organisation that advertised the role, or write to hello@taali.ai. Taali does not decide the merits — we acknowledge within three working days and route the request to the customer as controller, who resolves it within thirty days.
Security practices
Access to customer data is scoped per organisation and enforced server-side on every request, and a check in our build pipeline fails new route and service code that looks up an organisation’s record by id without checking the organisation. Candidate data is never used to train or tune a shared model across customers: scoring calibration for an organisation uses only its own outcomes.
Taali platform administrators must use multi-factor authentication, and any organisation’s owner can require it for every member. Owners can review an audit log of sign-ins, settings changes, document downloads, exports, shared links and API keys. Calls to Taali’s internal operator routes must name the operator and are recorded with the organisation they touched.
Top-candidate reports and shortlists get a shareable link only when a person chooses to share one. Candidate share links expire after at most 30 days and can be revoked, links for clients hide the candidate’s contact details unless the sender includes them, and internal links need a signed-in member of the organisation.
Anything not on this page
If you are diligencing Taali and need something this page does not cover, write to hello@taali.ai. We would rather tell you we do not have something yet than imply we do.