Capability
Identity broker and staged reveal
Anonymous screening only works if someone answers the obvious question: at what point, and on whose say-so, does the company find out who they are talking to?
A staged identity reveal is a consent-gated release of a talent’s real identity to one specific company at a defined point in the hiring process. CalHire acts as identity broker: the company never holds the talent’s identifying data during screening, and can request a reveal only at an allowed stage. The talent consents or declines. Consent releases identity to that company alone, and every request, consent, decline and disclosure is written to an immutable log both parties can see.
Last reviewed
The short version
- The company never holds identity during screening. CalHire does, as broker.
- A reveal can only be requested at an allowed stage, so it cannot be used as a shortcut around anonymous screening.
- Consent is per company. Revealing to one company reveals nothing to any other.
- Requests, consents, declines and disclosures are all written to an immutable log visible to the talent.
Why a broker, rather than a setting
Anonymity the company can switch off is not anonymity. It is a setting. If the identifying data sits in the company’s tenant behind a permission, then somebody has that permission, somebody else can be granted it, an export contains it, and an admin can read it on a Tuesday for no particular reason. The guarantee is only as strong as the weakest role in the customer’s own access model, which is not a guarantee at all.
So identity lives with CalHire and is released by an explicit, logged act. The company-facing record is built without identifying attributes, and there is no company-side permission that reads them, because the data is not in their tenant to read.
This is the same structure that escrow uses, for the same reason. Neither party has to trust the other about the moment of exchange, because neither party controls it.
The four steps of a reveal
- 1
The company requests
Only at a stage the platform permits, and typically when they want to move to a human conversation or an offer. The request states which organisation is asking and why, because a talent deciding whether to identify themselves deserves both facts.
- 2
The talent decides
Consent or decline. Declining is a normal, supported action with no penalty attached: the talent stays in the pipeline as an anonymous participant, and the company is told the reveal was declined rather than given a reason they were not offered.
- 3
Disclosure happens once, to one party
Consent releases identity to the requesting organisation only. There is no propagation to a shared pool, a partner, a job board or another tenant. A second company wanting the same thing has to ask separately.
- 4
The record is written and cannot be altered
Who asked, when, for which role, what the talent answered, and what was disclosed. Written to a hash-chained audit trail, exportable by the company and viewable by the talent.
What reveal unlocks, and what it does not
A named conversation
Interviews, references and everything else that requires knowing who someone is. Your interviewer also sees the talent’s profile photo, when one is on file, and records whether the person they met is the same. Screening is over; this is a normal hiring process from here.
Right-to-work checks
Work authorisation is verified after reveal, which is the correct order. It is a legal requirement attached to a person, not a screening criterion.
ATS and HRIS sync
Identity flows to your systems of record only after reveal. Nothing about an anonymous talent is ever synced out to a downstream system.
Nothing retroactive
A reveal does not unlock past anonymous activity in other pipelines. What was anonymous stays anonymous, including in your own historical records.
What this changes for talent
The most common reason good talent does not apply is that their current company might find out. Confidential job searching is a widespread, entirely reasonable behaviour that most hiring processes treat as somebody else’s problem, and the cost falls hardest on people who cannot afford to be seen looking.
Under a broker model, a talent can be assessed, ranked, interviewed in text and shortlisted without any company learning who they are. They find out that they are strong for a role before deciding whether to identify themselves for it. The exposure comes at the point where there is something concrete to weigh, rather than at the point of curiosity.
It also means a decline carries no cost. None at all. A talent who does not want to proceed with a particular company simply does not consent, and that company never learns which anonymous participant declined them.
What this does not do
It does not stop a talent identifying themselves. Someone who mentions their company in a free-text answer has revealed something the flow was designed to protect. Answers are structured to make it uncommon, and talent is warned, but no system can enforce discretion on a person who wishes to abandon it.
It does not survive re-identification from outside data. A sufficiently unusual combination of skills, market and timing can narrow a field to one person in a small enough industry. The protection is strong in a large market and weaker in a small one, and the honest version of this claim depends on where you hire.
It does not delay compliance obligations indefinitely. Right-to-work checks, nationals-quota reporting and background screening all attach to a real person, and all of them wait for reveal. If your process requires one of them earlier than reveal, the sequence needs designing rather than assuming.
It does not remove bias after the reveal. Everything that happens once the company knows who they are talking to is subject to the same biases as any other hiring process. The broker protects the screening stage; it does not follow the talent into the interview room.
Questions people actually ask
Can a company see identity before the talent consents?
What happens if a talent declines a reveal?
Does revealing to one company reveal to others?
Can a talent withdraw consent after revealing?
Is there a record we can show an auditor?
When is the right stage to request a reveal?
Related
Where this connects to the rest of the platform.
Anonymous talent screening
Companies evaluate talent with no name, photo, age, school or past company attached, because that information is never sent rather than merely hidden.
ATS integration, with API access coming soon
Two-way connectors for Greenhouse, Lever, SAP SuccessFactors, Zoho Recruit and Workable; Workday receives hires. API access is coming soon. Identity syncs only after a reveal.
AI governance, bias auditing and the audit trail
Adverse-impact analysis on the four-fifths rule, a hash-chained audit trail, talent appeals, and DSAR handling. The evidence exists before anyone asks for it.
Read the reasoning
The evidence and the argument behind what is on this page.
GDPR and candidate data: what recruiting teams get wrong
Consent is usually the wrong lawful basis for recruitment. What to rely on instead, how long to keep applications, and the rules on automated decisions.
ReadName-blind recruitment: the weakest form of blind hiring
Name-blind screening is the most adopted and least effective form of blind hiring. What a name signals, what survives redaction, and what to do instead.
ReadBlind hiring: what the evidence supports, and what it does not
Blind hiring has one of the cleanest natural experiments in labour economics behind it, and real limits. What it fixes, and what it cannot.
ReadUAE PDPL and candidate data: what recruiters in the Emirates need to know
The UAE has a federal data protection law plus separate free-zone regimes. Which applies to your hiring, and what changes about handling candidate data.
ReadSee a verified pipeline for one of your roles
Post a role free and review anonymous, skill-ranked talent. No card, no sales call to get started.