Product & Compliance Roadmap

Planning horizon: Rolling 24 months

The rolling two-year product and compliance roadmap for HiringCoachAI, organized by theme and timeframe. Items inside each tier are grouped by topic rather than strict sequencing. Dates are planning targets, not contractual SLAs, and the roadmap is reviewed quarterly so the forward-looking horizon stays current.

"Implemented" below means the capability is supported by the current product source and compliance record. The in-progress and horizon sections describe planned work, not current capabilities or contractual commitments.

In progress

Continuous trust-center maintenance. Quarterly audit reviews, drill records,

and evidence refreshes across security, privacy, AI use, and accessibility documentation.

Security automation hardening. The implemented baseline covers patch

verification, API input-validation review, outbound-fetch detection, and AI provider data-retention verification. Work in progress expands reliable release evidence and static and dynamic security scanning.

AI safety surface expansion. Input-safety and prompt-injection safeguards

are implemented on covered AI call paths. Broader route coverage is planned.

Accessibility evidence refresh. Live assistive-technology verification

cycles; ongoing ACR/VPAT maintenance.

Customer data-rights tooling. Self-service account export and deletion are

implemented for the authenticated account. Work in progress expands export coverage for additional first-party categories; some vendor-held records still require an assisted request.

On the horizon (next 12 months)

Independent attestations. Planned engagement with qualified third parties

for attestation reports, penetration testing, and accessibility verification. HiringCoachAI does not currently claim SOC 2 certification or an independent penetration test.

Identity and access enhancements. Native institutional OIDC SSO and

individual app-level TOTP MFA are implemented. Native SAML or Shibboleth connectivity, automated SCIM provisioning, granular institutional roles, and institution-enforced MFA policy controls are planned.

Operational reliability. A public status page and five-minute internal

probe are implemented. Independent external uptime probing and expanded incident communications are planned.

Privacy controls. Global Privacy Control handling is implemented in source

and awaits deployment verification. Expanded consent-management surfaces are planned. The source implementation is not yet claimed live.

Looking ahead (12-24 months)

Tenant-scoped enterprise foundations. Individual account export and

limited pilot reporting are implemented. Tenant-scoped audit-log export, customer-managed administrative reporting, customer-managed encryption-key options, and institutional customization are planned.

Multi-region resilience. Backup data uses documented United States

multi-region storage. Alternate-region application deployment beyond the current production footprint is planned.

Industry credentials. Privacy-management certification path following

initial attestation work, and broader compliance-program participation as customer demand justifies.

Aspirational

Bug-bounty program. Currently operated as a responsible-disclosure

program. Conversion to a paid program is on the long-horizon plan.

Federal-grade compliance paths. Would require a separately-scoped

deployment model and external sponsorship; not on the near-term horizon.

Recently shipped

Date Item

2026-06-12 Native institutional OIDC single sign-on with registered-domain enforcement and encrypted client credentials.

2026-05-15 HECVAT 4.1.5 institutional response refresh; comprehensive answer audit; trust-center reframe.

2026-05-07 First AI bias-evaluation baseline run archived.

2026-05-02 Customer-facing status page with auto-probe and admin editor.

2026-05-02 Documentation-review drills wired into the compliance review process.

2026-04-30 Full HECVAT 4.1.5 workbook coverage with automated audit guards.

2026-04-24 Public trust center launched with comprehensive compliance documentation.

Change log

Date Change

2026-10-01 Quarterly source and code review; separated implemented controls from planned work, moved native OIDC SSO to shipped, and clarified identity, GPC, uptime, tenant, encryption-key, and regional-deployment status.

2026-05-15 Reorganized by theme; consolidated specific item lists into thematic groupings; tightened forward-looking sections.

2026-05-11 Added explicit rolling 24-month planning horizon and 12-24 month section.

2026-05-02 Initial public roadmap.