OBSCURA for HR and recruiting
HR holds the most personal files in most organisations: CVs, payroll exports, grievance notes, the replies to a subject access request. The tools here work on those files in the browser, so a CV is blinded, a spreadsheet checked and a request answered without the material going to another service.
Where HR work goes wrong with files
Names in capitals are single tools: free to open and to check a file with, and Pro to save the result. A name marked Pro is a service inside the Sovereign Suite, which is Pro as a whole.
Shortlisting with the name still on the CV
A name, a photograph, a graduation year and a postcode all reach the reader before the experience does.
- BLIND: strips names, contact details, dates, schools and other identity markers from a batch of CVs (.docx, PDF or text) and returns packets labelled Candidate #1, #2, with a key kept by whoever runs the process
- INTERVIEW: the questions as the structure, timed notes against each, and a record laid out to be read back
Read first: whether it is safe to upload a CV.
Subject access requests
The clock starts the day the request arrives, whoever it reached and whether or not anybody recognised it as one.
- DSAR: counts the deadline, records what was searched and what was withheld and why, and drafts the reply; built around the GDPR and UK GDPR, with other periods selectable
- SEAL: redacts other people’s details from a PDF so the text is gone, not covered
- REDACTLOG: the schedule of each redaction and the ground for it
- DOCKET: lists every file being disclosed, with its SHA-256
Personal data in spreadsheets
An export is easier than a query, so it goes out with three more columns than anybody meant, a hidden sheet, or the whole source table cached inside a pivot.
- DATASCAN: finds the columns in a CSV or JSON file that hold emails, phone numbers, national identifiers, card numbers and addresses; names and free text have no shape and are not found
- CLEANSHEET: removes hidden and very hidden sheets, pivot caches, formulas, external links and comments from an .xlsx
- ANON: replaces names with codes from a keyed hash, the same code for the same person across every file
- CROWD: checks whether people can still be picked out of a dataset once the names are gone
Read first: what a spreadsheet hides and anonymising names in a spreadsheet.
Investigations and difficult conversations
The record made at the time is the one that is believed later.
The records the law asks for
Registers that are usually a spreadsheet nobody opens until someone asks for them.
- ROPA: the Article 30 record of processing activities, checked for gaps
- RETENTION: what is kept, why and for how long, and what is already past its date
- CONSENT: who agreed to what, when and to which wording, and every withdrawal
- BREACH: the form, the clock and the notification when something goes to the wrong person
Rotas, leave and hours
The arithmetic a spreadsheet does not check.
Sending an offer, a settlement or a file of records
The document is personal to one person, and an ordinary attachment is readable wherever it lands.
- Send a file securelyPro: files sealed into one page that opens with a passphrase sent another way
- PADLOCK: an AES-256 password on a PDF
- MERGE: one letter per row from a template and a list, as a PDF of every letter
Why it matters that the file stays on the machine
Candidates and employees did not choose the tools HR uses on their data. Each web service a CV or an export passes through is another organisation holding it, with its own terms, its own retention and its own risk of a breach, and usually another entry to make in the records HR already keeps.
A tool that never receives the file is not one of them. Here it is read from the disk and worked on in the tab, and nothing is uploaded; you can watch the network tab to confirm it.
It does not take away the organisation’s own obligations: a lawful basis for holding the data, how long it is kept, the security of the laptop it sits on, and the reply to the person who asked. Those stay with you.
A worked example: a subject access request
A former employee asks for everything held about them. On the HR adviser’s laptop:
- DSAR logs the request with the day it arrived, and the deadline is counted from then.
- The HR system’s export goes through DATASCAN, which shows which columns hold personal data, and CLEANSHEET, which finds a hidden sheet of salary history for the whole team. Only this person’s rows go into the reply.
- Emails that name colleagues are exported to PDF and go through SEAL, which removes the colleagues’ names for good. REDACTLOG records each redaction and why.
- X-RAY checks the finished files for anything left under a box or in the document properties.
- DSAR drafts the reply, and the files go through Send a file securely, with the passphrase given over the phone.
What it costs an HR team
Every tool above is free to open and to check a file with. Saving the blinded CVs, the cleaned spreadsheet or the redacted PDF is Pro.
- Free, for everyone
- The Workspace: Docs, Sheets, Slides, Notes, Calendar, Tasks, Contacts, Plan, Drive and the PDF editor, at work as well as at home. And every single tool on this page, to open a file and see what it finds, with no account.
- Pro, for one person
- $15 a month or $144 a year, with 7 days free. Saving the result in every tool outside the Workspace, the whole Sovereign Suite and the Photo Editor.
- Team, up to 25 people
- $69 a month or $690 a year, with 14 days free. Everything in Pro for up to 25 people on one key for the whole team, a Stripe invoice with your organisation’s name and tax number, and email answered by a person within a working day.
- Not included
- No admin console, single sign-on, audit log or shared team storage: each person’s work stays on their own machine. The page for teams lists the rest, with the answers a security reviewer will ask for.
From five people, Team costs less than five Pro subscriptions. Checkout is Stripe’s: the card is asked for at the start and not charged until the fourteen days are over, and if you cancel before then nothing is paid.
Questions
Does blind review remove bias?
It reduces the effect of names and backgrounds on a first read. It does not fix bias on its own, because the interview still happens. BLIND says the same on its own page.
Does DATASCAN find names?
No. It finds values with a shape: email addresses, phone numbers, national identifiers, card numbers that pass the Luhn check, IBANs, IP addresses, dates of birth and postal addresses. A column of names or of free-text notes looks like ordinary words, and is often the most sensitive thing in the file, so read those yourself.
Where are the registers kept?
In the browser on the machine where they were made. DSAR, ROPA, CONSENT and the other registers are private to that browser, not shared across the team, and clearing the browser’s site data removes them. Save the export each tool offers and keep it where your records live.
Is DSAR only for the GDPR?
It is built around the GDPR and UK GDPR: a calendar month, the extension for a complex request, and when the clock can pause. The deadline can also be set to 30 days, 45 days or any number, for other regimes. It does not tell you which rule applies.
Can the whole team use one subscription?
Yes, up to 25 people on the Team plan, with one key for the whole team. Each person adds it under Sign in on the Pro page.
The same tools, for other work
This page describes what the tools do. It is not legal or employment advice, and nothing on it says that using them meets any data protection requirement.