VPC-deployed AI hiring with zero customer production-data egress
VPC-deployed AI hiring runs inside the customer's AWS, Azure, or GCP environment. Nodes is single-tenant, with zero customer production-data egress and no external model call in the production data path. Candidate data, model operations, deployed customer-specific weights, and Decision Traces stay inside the approved boundary. A named human approves, edits, or declines before Nodes acts.
What the VPC boundary includes
Fine-tuning, inference, evidence storage, and approved execution run inside the customer VPC. Customer production data and deployed model artifacts remain inside the approved environment. The customer sets network policy, identity access, region, and retention.
The architecture uses open-source foundation models fine-tuned inside the customer environment. Deployed customer-specific weights remain under customer control and contractual exit rights. If the executed agreement permits shared improvement, a PII-stripped weight artifact may leave only after two PII checks and explicit customer approval. Optional aggregate operational telemetry contains no customer data and can be disabled. Neither path carries customer production data.
The production data path
Nodes reads only the sources approved for one defined decision program. Candidate and employee records are processed inside the customer boundary. No hosted foundation-model API receives that data.
Each connector uses scoped permissions. A canonical glossary defines expected fields, and the mapping layer assigns confidence to each proposed match. A human verifies anything uncertain. If a field changes and no longer maps cleanly, the flow stops for review.
The human gate and Decision Trace
Nodes proposes a recommendation with its evidence and expected business effect. A named person can approve, edit, delay, or decline it before execution.
A signed Decision Trace records the evidence available, model and policy versions, recommendation, human input, approved action, and later outcome. Designated regulated workflows can require a second signer.
What the public deployment proves
The current production evidence comes from enterprise talent at one Fortune 500 insurance carrier. That deployment completed legal approval in 17 days and moved from contract to production in 34 days after six AI hiring vendors had been rejected over 18 months on architecture.
Those results explain why the boundary matters. They do not promise the same review or deployment timeline for another customer. Every new company and decision program starts with separate historical validation and its own security review.
What is available for review
- SOC 2 Type I and Type II reports under NDA
- the deployment data-flow diagram
- connector permissions and proposed field mappings
- model ownership and exit terms
- Decision Trace and human-approval behavior
- the controls that stop uncertain mappings or weak evidence from moving forward
Frequently asked questions
What is VPC-deployed AI hiring? AI hiring software that runs inside the customer's virtual private cloud, with candidate data and model operations contained inside that approved boundary.
Does Nodes send candidate data to an external model provider? No. There is no external model call in the production data path. Fine-tuning and inference run inside the customer VPC.
Who owns the model weights? Customer-specific weights remain under customer control. The agreement defines the precise exit, export, and transition mechanics.
Does Nodes make the final hiring decision? No. Nodes proposes and explains. A named human approves, edits, delays, or declines before any action executes.
Review the boundary for one decision
Bring one repeated hiring decision, the systems it crosses, and the security constraints that govern it. Nodes will map the data path, evidence requirements, human gate, and stop conditions before a production scope is proposed.