Product & Compliance Roadmap

<p><strong>Planning horizon:</strong> Rolling 24 months</p> <p>The rolling two-year product and compliance roadmap for HiringCoachAI, organized by theme and timeframe. Items inside each tier are grouped by topic rather than strict sequencing. Dates are planning targets, not contractual SLAs, and the roadmap is reviewed quarterly so the forward-looking horizon stays current.</p> <p>&quot;Implemented&quot; below means the capability is supported by the current product source and compliance record. The in-progress and horizon sections describe planned work, not current capabilities or contractual commitments.</p> <h2>In progress</h2> <ul><li><strong>Continuous trust-center maintenance.</strong> Quarterly audit reviews, drill records,</li></ul> <p> and evidence refreshes across security, privacy, AI use, and accessibility documentation.</p> <ul><li><strong>Security automation hardening.</strong> The implemented baseline covers patch</li></ul> <p> verification, API input-validation review, outbound-fetch detection, and AI provider data-retention verification. Work in progress expands reliable release evidence and static and dynamic security scanning.</p> <ul><li><strong>AI safety surface expansion.</strong> Input-safety and prompt-injection safeguards</li></ul> <p> are implemented on covered AI call paths. Broader route coverage is planned.</p> <ul><li><strong>Accessibility evidence refresh.</strong> Live assistive-technology verification</li></ul> <p> cycles; ongoing ACR/VPAT maintenance.</p> <ul><li><strong>Customer data-rights tooling.</strong> Self-service account export and deletion are</li></ul> <p> implemented for the authenticated account. Work in progress expands export coverage for additional first-party categories; some vendor-held records still require an assisted request.</p> <h2>On the horizon (next 12 months)</h2> <ul><li><strong>Independent attestations.</strong> Planned engagement with qualified third parties</li></ul> <p> for attestation reports, penetration testing, and accessibility verification. HiringCoachAI does not currently claim SOC 2 certification or an independent penetration test.</p> <ul><li><strong>Identity and access enhancements.</strong> Native institutional OIDC SSO and</li></ul> <p> individual app-level TOTP MFA are implemented. Native SAML or Shibboleth connectivity, automated SCIM provisioning, granular institutional roles, and institution-enforced MFA policy controls are planned.</p> <ul><li><strong>Operational reliability.</strong> A public status page and five-minute internal</li></ul> <p> probe are implemented. Independent external uptime probing and expanded incident communications are planned.</p> <ul><li><strong>Privacy controls.</strong> Global Privacy Control handling is implemented in source</li></ul> <p> and awaits deployment verification. Expanded consent-management surfaces are planned. The source implementation is not yet claimed live.</p> <h2>Looking ahead (12-24 months)</h2> <ul><li><strong>Tenant-scoped enterprise foundations.</strong> Individual account export and</li></ul> <p> limited pilot reporting are implemented. Tenant-scoped audit-log export, customer-managed administrative reporting, customer-managed encryption-key options, and institutional customization are planned.</p> <ul><li><strong>Multi-region resilience.</strong> Backup data uses documented United States</li></ul> <p> multi-region storage. Alternate-region application deployment beyond the current production footprint is planned.</p> <ul><li><strong>Industry credentials.</strong> Privacy-management certification path following</li></ul> <p> initial attestation work, and broader compliance-program participation as customer demand justifies.</p> <h2>Aspirational</h2> <ul><li><strong>Bug-bounty program.</strong> Currently operated as a responsible-disclosure</li></ul> <p> program. Conversion to a paid program is on the long-horizon plan.</p> <ul><li><strong>Federal-grade compliance paths.</strong> Would require a separately-scoped</li></ul> <p> deployment model and external sponsorship; not on the near-term horizon.</p> <h2>Recently shipped</h2> <table><thead><tr><th>Date</th><th>Item</th></tr></thead><tbody><tr><td>2026-06-12</td><td>Native institutional OIDC single sign-on with registered-domain enforcement and encrypted client credentials.</td></tr><tr><td>2026-05-15</td><td>HECVAT 4.1.5 institutional response refresh; comprehensive answer audit; trust-center reframe.</td></tr><tr><td>2026-05-07</td><td>First AI bias-evaluation baseline run archived.</td></tr><tr><td>2026-05-02</td><td>Customer-facing status page with auto-probe and admin editor.</td></tr><tr><td>2026-05-02</td><td>Documentation-review drills wired into the compliance review process.</td></tr><tr><td>2026-04-30</td><td>Full HECVAT 4.1.5 workbook coverage with automated audit guards.</td></tr><tr><td>2026-04-24</td><td>Public trust center launched with comprehensive compliance documentation.</td></tr></tbody></table> <h2>Change log</h2> <table><thead><tr><th>Date</th><th>Change</th></tr></thead><tbody><tr><td>2026-10-01</td><td>Quarterly source and code review; separated implemented controls from planned work, moved native OIDC SSO to shipped, and clarified identity, GPC, uptime, tenant, encryption-key, and regional-deployment status.</td></tr><tr><td>2026-05-15</td><td>Reorganized by theme; consolidated specific item lists into thematic groupings; tightened forward-looking sections.</td></tr><tr><td>2026-05-11</td><td>Added explicit rolling 24-month planning horizon and 12-24 month section.</td></tr><tr><td>2026-05-02</td><td>Initial public roadmap.</td></tr></tbody></table>