Instrument · steadywrk.com
Authority you can verify.
Attestation. Index. Evals.
This domain sells the instrument — public proof surfaces for dispatch evals, market readiness indexing, GEO citation methodology, and audited-operations pilots. Numbers below come from the canonical metrics file. No invented claims.
Operators & tools → steadywrk.app
90%
Completion· rolling 30-day
340ms
Dispatch P50· estimated
3%
Human override· rolling 30-day
<2hr
Quote turnaround· target
Live proof surfaces
Four routes. Curl them. Cite them.
Every card links to a shipped page. Eval numbers are rolling 30-day estimates from CANONICAL_METRICS — the same source the public JSON feed uses.
Evals API (JSON · no key)
curl https://steadywrk.app/api/dispatch/analytics/evals?period=rolling_30dRelated rails
Store Guard · attestation · verify
Platform controls
Eight signals. Every one documented.
PDPL-Aware Privacy Posture
Privacy controls are mapped against Jordan PDPL expectations, including consent tracking, data minimization, and documented ownership for processing activity reviews.
Data Residency
Candidate data stays in region. We do not move personal data across jurisdictions without explicit consent and a documented lawful basis.
Enterprise Authentication
SOC 2 Type II upstream authentication. WebAuthn passkeys, enforced MFA on operator surfaces, and short-lived JWTs that rotate on every refresh.
Rate Limiting & Bot Shield
Sliding-window rate limits across all public APIs. Edge bot detection and shield rules intercept automated probing before it reaches application logic.
Full Audit Trail
Every state transition — application received, stage change, interview scheduled, offer issued — is append-only and timestamped. Seven-year retention as standard.
Encrypted at Rest & in Transit
TLS 1.3 enforced in transit. AES-256 at rest on managed Postgres. Secrets live in the deploy environment layer only — zero plaintext in the repo.
Privacy-Ready Architecture
Lawful basis documented per processing activity. DSAR workflow live. Subprocessor registry published at /security/subprocessors for procurement review.
AI Disclosure Standards
Every AI-assisted decision is logged, disclosed to the candidate, and overridable by a human reviewer. No autonomous accept or reject without a human in the loop.
Data handling
What we collect, why, and who sees it.
What we collect
Name, contact details, work history, credentials, and skills provided directly by the applicant. Nothing inferred from third-party data brokers.
Why we collect it
To place verified operators and field talent into real work — operator seats, employer work orders, and AI-ops roles. No secondary use for advertising, profiling, or resale.
Who sees it
Only hiring managers and dispatch operators with an active, scoped need relevant to the candidate skills and geography. Access is logged.
How long we keep it
Active profiles retained while the candidate is in-platform. Inactive profiles purged on request or after 24 months of inactivity, whichever comes first.
Your rights
Access, correction, deletion, and portability on request. Email privacy@steadywrk.app with subject "DSAR" and we respond within 72 hours.
Need the workforce path?
Operators & tools → steadywrk.app. Instrument proof stays here on steadywrk.com.