Lighthouse AI Governance Policy

This is the customer-facing summary of Lighthouse's internal AI governance policy. It describes how we decide, build, ship and review the features in our applicant tracking system that use language models. It is suitable for sharing with customers, auditors and security reviewers.

Scope of this policy

The policy covers every feature of the Lighthouse service that calls a language model: resume parsing, employer classification, location and distance estimates, scorecard drafting and suggestions, assistance features for platform users (job descriptions, interview questions, search, campaign drafts) and applicant fit summaries. Each is listed in an internal AI system inventory that records its purpose, provider, model, the data it sends, where its output goes, its human review point and its owner. The inventory is re-verified against the code every 6 months and before each customer security review. Lighthouse does not train or fine-tune any model.

How Lighthouse uses AI

Lighthouse is an applicant tracking system that employers and recruitment firms use to receive, review and manage job applications. We primarily use AI to help our customers identify and assess candidates for their job postings:

• Language models parse each resume into a structured candidate profile.
• Our scoring engine, which is deterministic code rather than a model, scores each profile against the scorecard of the posting it applied to.
• Language models help platform users draft scorecards, write job descriptions and messages, and search past applicants.

Because these features inform decisions about people's employment, the principles below set the limits on how we build them and how they may be used.

Principles for AI in candidate screening

Hiring decisions stay with the customer's platform users. Lighthouse produces parsed profiles, scores and summaries; the customer's platform users decide whom to advance or reject. Customers can build automations that move a candidate to another stage on a score condition. No automation is on by default: a customer user creates, reviews and activates each one, per job posting, and Lighthouse does not configure them. A stage, including a rejection stage, is a list for the customer's users to review, and moving a candidate there is not by itself a rejection. Our terms require customers not to use AI output as the sole or determinative basis for an adverse decision and to keep meaningful human review. A model-written applicant fit summary can be inserted into customer emails and automation messages; it is intended for hiring managers and other recipients the customer chooses, not candidates. The platform does not insert fit summaries into messages addressed to candidates.

Scoring is deterministic and explainable. Candidate scores are computed by a deterministic rules engine; language models do not score candidates. Language models parse resumes into structured profiles and help platform users draft scorecards. Parsed fields such as industry and seniority feed the rules, so our bias audit evaluates the whole pipeline, parsing plus scoring. Platform users review the AI-drafted search criteria a scorecard is built from, can edit a scorecard at any time, and AI-suggested scorecard changes apply only on their confirmation.

Customer data is not used to train models. We train no models, and our product uses model providers only under terms that exclude training on our data. Our OpenAI account's data controls have all data sharing disabled.

Features are designed to send a model only the data they need. Features that need no candidate data send none, and resume parsing sends the resume, which its purpose requires.

No claim about AI goes into a customer document without evidence. Every statement in this document is backed by an internal document that cites code, configuration or a dated decision.

Prohibited uses of AI

Lighthouse does not use AI, and does not build features that use AI, for any of the following:

• Analysing candidates' video, voice or facial features.
• Inferring protected characteristics, such as sex, race, age, disability, religion or national origin.
• Using language model output as a candidate's score or to make a hiring decision.
• Training or fine-tuning models on customer or candidate data.

Who is accountable

The CTO is accountable for every AI system in scope. The CEO approves every AI statement made to a customer. A change to the policy needs approval from the CEO and the CTO.

AI model providers and the data they receive

No other model provider receives customer or candidate data in our product. Our database provider's built-in AI assistant is disabled for our organization. Prompt and model evaluation that uses real resumes uses only resumes held in Lighthouse's own test organization, on controlled development machines, with the data deleted when the evaluation ends. Data is hosted in the United States; some AI providers, such as Gemini and Anthropic, do not guarantee where they process data. Data processing terms are in force with our database provider and with the host of our automation platform, which runs in the United States. Multi-factor authentication is active on our infrastructure consoles.

Process for releases containing AI changes

• A new model call is added to the AI system inventory and the AI risk register in the same change.
• A model or prompt change passes our evaluation process before release.
• Model output that reaches a candidate or third party without human review requires a recorded decision.
• Our screening pipeline uses fixed, dated model versions; where a feature uses a provider-managed model, it is reviewed under the same change process.

Staff use of AI tools

Staff may use only Claude and Claude Code with company data, with the setting that shares conversations for model improvement turned off. Staff use of AI tools is governed by this policy, and candidate personal information is not entered into general-purpose AI assistants. Development assistants with production access may read data but may not change the database schema, handle credentials, or copy candidate data into internal documentation. Staff read this policy when they join and each year, and take part in the annual incident response exercise.

Annual bias audit

In compliance with NYC Local Law 144, an independent bias audit of candidate scoring is conducted every year, and each audit covers the product and model changes made since the previous one. The most recent audit was completed in August 2026 by an independent external expert. It scored 6,030 synthetic resume variants across 50 job postings through the production pipeline, parsing included. The lowest impact ratio on the final score was 0.976, and the lowest across the four component scores was 0.956. As the auditor notes, the audit used synthetic, balanced data, measures disparity rather than causation, and does not assess job-relatedness. The audit summary is published at https://www.lighthousehiring.ai/assets/docs/lighthouse-bias-audit-2026.pdf.

Monitoring between bias audits

Between annual audits, scoring is monitored in two ways:

• Every change to a model, prompt or scoring rule passes our evaluation process before release.
• The CTO reviews a weekly report on how well scores agree with platform users' screening decisions across job postings, and each job posting with enough screening decisions shows that agreement in the app.

AI risk management and policy review

AI risks are rated on a 3 x 3 likelihood and impact scale and kept in a register with an owner and review date for each. High risks are reviewed monthly, the full register every 6 months and before each customer security review, and the policy every 12 months. The CEO and the CTO formally review the policy each January and record the review.

Policy exceptions and AI incidents

Exceptions need a written reason, an owner, approval by the CEO or the CTO and an expiry of at most 6 months. Harmful or wrong model output, a model provider compromise or outage, and candidate data leaving through a model provider are handled as incidents under our written incident response plan, which has a section on AI incidents.

Standards this policy maps to

The policy is mapped to the NIST AI Risk Management Framework 1.0 and to ISO/IEC 42001:2023. Lighthouse is not certified to ISO/IEC 42001.