Draft
Trust Center
Draft 0.1 · 19 October 2026 · Status: Draft
HAIQ is a pipe, not a database. This page publishes the rules we are building HAIQ to, and it tracks honestly which of them are real today. Almost everything below is Planned: designed and written down, not yet built. We will only mark an item Live when it runs in production and its test runs on every release.
Status legend
| Status | Meaning |
|---|---|
| Planned | Designed and written down. Not built yet. |
| In progress | Being built now. Not in production. |
| Live | Running in production, with its test on every release. |
Principles
These are the design rules for HAIQ v1 and later. They describe the product we are building, not a service that is running today.
| # | Principle | The rule we hold ourselves to |
|---|---|---|
| P1 | Pure score output | The only artifact that outlives grading is a signed score credential. The candidate is its holder. |
| P2 | No data retention anywhere | No candidate content, identity or score is stored by HAIQ. Ciphertext in transit is deleted after grading, with a hard limit of 24 hours. No third party touches candidate data, including LLM APIs and analytics. |
| P3 | Verifiable, not promised | Grading code is open source and reproducibly built, and its measurement is published to a transparency log. From Phase 3, the CLI checks an enclave attestation before it sends a single byte. |
| P4 | Open architecture | The CLI, session format, verifier, grader core, standard and benchmarks are open. Only the hidden task tests and the signing keys are secret: open method, secret exam. |
| P5 | Open standards | Credentials use W3C Verifiable Credentials 2.0 and Open Badges 3.0, with Data Integrity proofs and a Bitstring Status List, so anyone can verify them offline. |
| P6 | Transparency through benchmarks | We publish privacy, validity, neutrality, gaming-resistance and fairness benchmarks, with thresholds and a cadence. A failed benchmark blocks a release. |
| P7 | Robust and professional | Service objectives, a supply-chain policy, a security policy, incident response and a public status page. |
Data inventory
What each kind of data is, where it lives, who can read it and how long it exists, in the v1 design. Today, the only personal data HAIQ holds is the waitlist. Everything else in this table describes v1, which is not live yet.
| Data | Lives where | Who can read | Retention |
|---|---|---|---|
| Your agent logs (full history) | Your machine | You | Never leaves it. Self-Check only reads it. |
| Task session (redacted) and final repo bundle | Your machine, then ciphertext in transit, then grader memory | The grader only (encrypted to its key) | Seconds in grader memory. Ciphertext deleted on grading, hard limit 24 hours. |
| Hidden task tests | Encrypted object store | Only the attested grader image (Phase 3); a restricted HAIQ operations role in v1 | Lifetime of the task form |
| Score credential | The candidate's CLI or wallet, and wherever they share it | The holder, plus whoever they share it with | The holder decides. HAIQ keeps no copy. |
| Share link (credential in the link, rendered without storage) | The URL | Anyone with the link | Not stored. Host request logs keep the path only, for the host's minimum retention. |
| Task record (code, employer, deadline, start and submit times, status) | Our database | The employer and HAIQ | Task close plus 90 days (billing), then deleted |
| Employer account (company, contact, billing) | Our database and payment processor | The employer and HAIQ | Account lifetime |
| Waitlist (the fields in the form) | Our database | HAIQ | Until converted, or until you ask us to delete it |
| Revocation status list | Public static file | Everyone | Credential lifetime. Contains no personal data. |
Invariants, each to be enforced by an automated test: no table holds candidate names, emails or content; no log line contains payload bytes; no third-party code loads on candidate flows.
Privacy Standard
Each guarantee gets an automated test, and the test is a release gate.
| ID | Guarantee | How we will prove it | Release gate | Status |
|---|---|---|---|---|
| PS-1 | Self-Check makes zero network calls after install | CI runs the check under a network-denied sandbox and asserts success with no sockets opened. A static rule bans network modules in the Self-Check code. | Yes | In progress (B1) |
| PS-2 | Task capture is scoped | Fixture machines with unrelated sessions: a submission contains zero events outside the task directory and time window. | Yes | Planned |
| PS-3 | Secrets never leave | A canary suite of about 200 planted secrets (API keys, tokens, private keys, env lines). None may appear in a submission, and recall is reported. | Yes (99.5% recall or better) | Planned |
| PS-4 | The relay can't read submissions | The relay holds no decryption key, and a test asserts it never holds plaintext. | Yes | Planned |
| PS-5 | The grader retains nothing | v1: the filesystem is identical before and after a grading run, and a log scanner finds no payload bytes. Phase 3: an enclave with no storage, plus attestation. | Yes | Planned |
| PS-6 | No third parties on candidate flows | A network capture of the full candidate flow allows only haiqup.ai and the grader endpoint. | Yes | Planned |
| PS-7 | Verifiable transparency | Every grader measurement appears in the transparency log before it serves traffic, and the CLI refuses unknown measurements. | Yes (Phase 3) | Planned |
| PS-8 | The credential is score-only | A schema validator rejects any credential field outside the allow-list. | Yes | Planned |
Measurement Standard
How we will show the score measures something real, fairly, across tools.
| ID | Benchmark | Method | Threshold | Cadence | Status |
|---|---|---|---|---|---|
| MS-1 | Expert agreement | Two or more independent expert graders on the public calibration set (50+ at pilot, 200+ at launch) | Weighted kappa of 0.6 at pilot, 0.7 at launch | Each rubric release | Planned |
| MS-2 | Determinism | Re-grade identical submissions | 100% identical | Every build | Planned |
| MS-3 | Test-retest | The same people on parallel task forms | Correlation of 0.7 or more | Quarterly | Planned |
| MS-4 | Vendor neutrality | Scripted, equivalent work through Claude Code, Codex, OpenClaw and Cursor | Index difference of 5 points or less | Each adapter release | Planned |
| MS-5 | Gaming resistance | A red-team suite: padded test runs, fake logs, copied solutions, token farming, ritual-only plans | No attack raises the Index by more than 3 points | Each rubric release | Planned |
| MS-6 | Adverse impact | Four-fifths rule across operating system, agent tool, primary language and opt-in demographic panels. An independent audit is planned before any use in New York City. | Ratio of 0.8 or more, or a documented remediation | Before launch, then yearly | Planned |
| MS-7 | Explainability | Every point traces to a published rule, and the candidate can see the explanation locally | 100% coverage | Every build | Planned |
| MS-8 | Human oversight | The credential and console state that the score is not a sole basis for a decision, and ship interview debrief prompts | Present | Every build | Planned |
We hold no certifications and make no compliance claims today. The standard is being designed with the NIST AI Risk Management Framework and the EU AI Act's requirements for employment uses in mind, and the benchmark reports will be published here, starting in Phase 3.
Changelog
- Draft 0.1 — 2026-10-19. First public draft: principles, data inventory, Privacy Standard and Measurement Standard, all with honest status.
Report a security issue
Found a vulnerability? See how to report a security issue, or our security.txt.