Ask for documents, not just answers, and score every response by how strong its evidence is. Put a short list of pass-or-fail requirements first: where data is stored and who processes it, how fast the vendor tells you about a breach, deletion on request, no automatic rejection, and whether your candidate data is reused to improve models. Then add weighted criteria for workflow fit, scoring transparency, evidence quality, a pilot on your own data and price. Rate each answer on a five-level ladder from 0 (no answer) to 4 (proved in a pilot on your own data), so a confident claim with no document scores 1, not 3. HyreTech is a vendor in this category, and how we score on the same ladder is in the last section before the FAQ.
This guide is for HR, procurement and security teams at larger employers and agencies in Singapore, Indonesia, Australia and New Zealand who are writing an RFP for AI recruiting software. It does not repeat the question lists we have already published.
For the questions themselves, see our buyer's checklist for AI recruitment software in Singapore and the six questions in our guide to adding AI screening beside an enterprise ATS. This article covers what to request as evidence and how to score what comes back.
Checked against official sources on 21 October 2026. This is general information, not legal advice. The weights and the worked example below are illustrations, and the vendors in the example are invented. Because we sell in this category, score our public pages and answers with the same ladder you use for everyone else.
Questions Tell You What a Vendor Says, Documents Show What it Can Prove
A question list produces answers, and almost every vendor answers almost every question confidently. The RFP only separates vendors if you can tell a claim from a proof. We suggest rating every response on this ladder:
| Level | What the vendor gave you | Example |
|---|---|---|
| 0 | No answer | The question was skipped |
| 1 | A claim only | "We take security seriously" |
| 2 | A written policy or published list | A dated privacy policy or sub-processor list |
| 3 | Independent evidence with its scope visible | An audit report or certificate that states what it covers and when |
| 4 | Proved on your own data | A pilot you ran and scored yourself |
The ladder works because it is blunt. It stops a polished sales answer from outscoring a plain document. It also matches how regulators think about buying AI.
Australia's privacy regulator, the OAIC, says organisations adopting a commercially available AI product should conduct due diligence to ensure the product is suitable, that this should not be a "set and forget" approach, and that a privacy by design approach includes a privacy impact assessment. A rating that can move up to level 4 in a pilot, and be re-checked later, fits that advice.
Pass or Fail First: Requirements You Should not Weight
Some requirements should be gates, not points. If a vendor fails one, a high score elsewhere should not rescue it. We suggest treating a gate as met at level 2 or higher, so a claim alone (level 1) counts as not met. The enterprise guide's six questions show how to word each one.
- Where candidate data is stored and processed, and who processes it. Ask for the named sub-processor list, with what each one receives and where. For the cross-border side, see our guide to AI ATS data transfers for teams in Australia and New Zealand.
- A breach notice window shorter than your own legal clock. The breach-clock table below shows the four clocks.
- Deletion on request, with a stated time.
- No automatic rejection. A person decides. For the rules on automated decisions, see our guide to AI hiring compliance in Singapore, Australia and New Zealand, which also covers Australia's APP 1.7, due to start on 10 December 2026.
- Whether your candidate data is reused to improve models, by the vendor or by its AI provider, stated in writing. The AI provider is a separate company, so ask about both, and score each answer on its own.
Everything else can be weighted, because it is a matter of degree rather than a deal-breaker.
The Evidence Pack: What to Request, What it Proves, What it Does not
Ask for each document by name in the RFP. Then read what it does and does not show.
| Document to request | What it proves | What it does not prove |
|---|---|---|
| Privacy or data protection impact assessment, or a summary of it | The vendor mapped data flows and risks for this product | That your own use is assessed. The OAIC's PIA guide says your organisation is responsible and accountable for the personal information it collects, even when it is held by external service providers, so a vendor's assessment is an input to yours, not a replacement. New Zealand's Privacy Commissioner also publishes PIA guidance |
| Sub-processor and data-location list | Where candidate data goes and who touches it | That each recipient meets the standard you need |
| Independent security attestation, such as a SOC 2 report or an ISO/IEC 27001 certificate | An independent party examined controls within a defined scope and period | That the product and environment you will use sit inside that scope. Read the scope statement and the dates |
| Breach notice clause in the contract | The vendor will tell you within a stated window | That a breach will not happen |
| Data processing terms | Who instructs whom, retention, deletion, notice of sub-processor changes | That practice matches the paper |
| Scoring documentation | How a score is built, which inputs count, where a person decides | Accuracy on your roles |
| Pilot results on your data | How the product behaves on your candidates | That the result holds beyond your sample |
The last row is the only one that reaches level 4. For how to run that pilot, see the back-test section of our enterprise screening guide: take a role you have already filled, upload its applicants, and compare the ranking with the person you hired.
Breach Notice Clocks: Why The Vendor's Promise Must Fit Yours
A vendor's breach promise only helps if it is faster than your own legal clock. Each country sets a different one:
| Country | Your clock | Source |
|---|---|---|
| Singapore | Assess whether a breach is notifiable within 30 calendar days of having credible grounds to believe it happened. If it is, notify the PDPC as soon as practicable and no later than 3 calendar days after the day you make that assessment. Notify affected individuals at the same time or after, unless an exception applies | PDPC and its 2021 guide to managing and notifying data breaches |
| Indonesia | Written notice to affected individuals and the data protection authority within 3 × 24 hours when personal data protection fails. The notice must say what data was exposed, when and how, and what you are doing about it | UU 27/2022 (PDP Law), Article 46 |
| Australia | When you have reasonable grounds to suspect an eligible breach, take all reasonable steps to complete an assessment within 30 calendar days. If it is an eligible breach, notify the OAIC and the individuals at risk as soon as practicable | OAIC quick reference guide |
| New Zealand | Notify the Privacy Commissioner and affected people as soon as practicable. The Commissioner expects notice within 72 hours of becoming aware that a breach is notifiable, as a guide only | Privacy Commissioner |
Indonesia's law does not say exactly when the 72 hours start. Its implementing regulation, reported as PP 33/2026, was not on the official BPK database when we checked, so read the clock as starting when you become aware and confirm the detail with counsel.
Your Vendor's Clock
Only one of the four countries puts a deadline on the vendor itself:
- Singapore. A data intermediary that has reason to believe a breach has occurred in data it processes for you must notify you "without undue delay" (PDPA section 26C(3)(a)). Your own 30-day assessment then starts from what it tells you.
- New Zealand. The Privacy Commissioner says information known by your employees or agents is treated as known by your organisation. Your 72 hours can start when the vendor finds out, not when it tells you.
- Australia. The Privacy Act sets no separate deadline for a service provider to tell its customer. Where you and the vendor both hold the data, only one of you needs to assess and notify, but if neither does, both can be found in breach. The OAIC suggests agreeing who does what when you sign the service agreement.
- Indonesia. The PDP Law's 3 × 24-hour notice falls on the controller, which is you. Article 46 is not one of the duties the law extends to processors, and processing on your behalf stays your responsibility (Article 51). Only the contract makes the vendor tell you in time.
Two practical points follow. First, a vendor that promises to tell you "within 30 days" can break your Singapore, Indonesian and New Zealand clocks. Write a window into the contract that is shorter than the shortest clock you face, and ask for it in hours.
Second, decide in the contract who assesses and who notifies when the vendor is involved, because in Australia the duty can fall on either party and in New Zealand the vendor's knowledge can start your clock.
A Scoring Sheet: Gates, Weights and a Worked Example
Score the gates first, then the weighted criteria. For each weighted criterion, rate the response from 0 to 4 using the ladder. Points equal the weight times the rating divided by 4.
| Criterion | Type | Illustrative weight | What scores well |
|---|---|---|---|
| Data location and processors | Gate | n/a | Level 2 or higher |
| Breach notice window | Gate | n/a | Level 2 or higher, and shorter than your clock |
| Deletion on request with a stated time | Gate | n/a | Level 2 or higher |
| No automatic rejection | Gate | n/a | Level 2 or higher |
| Reuse of your data to improve models, stated in writing | Gate | n/a | Level 2 or higher, for the vendor and its AI provider |
| Fit with your hiring workflow | Weighted | 30 | Demonstrated on your process |
| Scoring transparency and human oversight | Weighted | 20 | Documentation, plus a person decides |
| Evidence quality (privacy and security) | Weighted | 20 | Level 3, with a scope that covers the product you are buying |
| Pilot on your own data | Weighted | 20 | Level 4 |
| Total cost | Weighted | 10 | A clear unit and no surprises (see AI recruiting software pricing models) |
Evidence quality tops out at 3 for every vendor, because a pilot on your data does not prove security. That costs every vendor the same 5 points, so it does not change the ranking.
Here is how it plays out for two invented vendors that both pass the gates:
| Criterion | Weight | Vendor A (rating, points) | Vendor B (rating, points) |
|---|---|---|---|
| Fit with workflow | 30 | 4, 30 | 3, 22.5 |
| Scoring transparency | 20 | 2, 10 | 3, 15 |
| Evidence quality | 20 | 1, 5 | 3, 15 |
| Pilot on your data | 20 | 0, 0 | 4, 20 |
| Total cost | 10 | 3, 7.5 | 2, 5 |
| Total | 100 | 52.5 | 77.5 |
Vendor A wins the demo and loses the RFP, because most of its answers are claims. That is the point of the ladder.
What a Smaller Vendor Can Offer Instead of Certificates
A strict reading of the ladder can disadvantage young vendors, which often have no SOC 2 report or ISO certificate yet. We suggest you do not fail them automatically. Give credit at level 2 for what they can publish today: a dated privacy policy, a named sub-processor list, a statement of where data is stored, and written terms for deletion and breach notice. Then give them a way to reach level 4 through a pilot on your data. If they have a dated plan for an independent audit, record it, but do not score the plan as if it were the report.
The same rule applies to every vendor, including us. A vendor with a certificate whose scope excludes the product you are buying has earned a level 1 on that line, not a level 3.
Turn The Ladder Into Your RFP Appendix
The simplest next step is to copy the ladder and the scoring sheet into your RFP as an appendix, and tell vendors up front that unsupported claims score 1. Vendors that respond with documents will stand out, and the pilot becomes the tiebreaker instead of an afterthought.
How HyreTech Scores on This Ladder
We are a small Singapore company with no SOC 2 report and no ISO certificate, so this is what our public pages support today. We have scored ourselves strictly. Check each line against the page it points to.
| Requirement | Our level today | Where to check |
|---|---|---|
| Where data is stored and who processes it | 2. Our privacy policy names the sub-processors that receive candidate data and what each receives, and says where the main ones process it | Privacy policy, where candidate data is processed |
| Breach notice to you within a stated window | Not met today. Our privacy policy commits to notifying regulators and affected individuals as the law requires, but no published page gives customers a notice window | Ask us for one in the contract |
| Deletion on request with a stated time | 2. Within 30 days of a verified request to privacy@hyretech.ai. This is a manual process, not a button | How to ask |
| No automatic rejection | 2. The AI labels candidates Shortlist, Consider or Reject, but a label never changes a candidate's status, and rejection emails are only sent by a person | Privacy policy, how weights become a score |
| Reuse of your data to improve models | 2. Our terms set out in writing what we may and may not do with client data to improve our AI. We make no claim here about our AI provider's own practices | Terms |
| Independent security attestation | None held. On evidence quality we reach level 2, not 3 | n/a |
| Scoring documentation | 2. The weighted average, the deal-breaker penalty and the label cut-offs are published | How AI candidate matching works |
| Pilot on your own data | Up to 4, if you run one. There is no export of scores, so record the comparison with your own hire yourself | Back-test steps |
On your sheet, that means we fail the breach-notice gate until the window is in writing. If you are evaluating us, ask for it, and score the answer you get the same way you would score anyone else's.
To run a small pilot on your own candidate data: Start free. The free plan includes one active role and a one-time grant of 20 credits, and one credit analyses one resume.
If you are drafting an RFP across Singapore, Indonesia, Australia and New Zealand and want to talk it through: Book a demo and we will walk through your requirements.
FAQ
We are writing an RFP for AI screening software and hire across Singapore, Indonesia, Australia and New Zealand. What evidence should we ask for, and how do we score a vendor with no SOC 2 report?
Ask for documents rather than answers: an impact assessment or its summary, a sub-processor and data-location list, an independent attestation with its scope, breach notice and processing terms in the contract, scoring documentation, and a pilot on your data. Rate each response from 0 to 4 on the evidence ladder. A vendor without a SOC 2 report can still earn level 2 for published policies and lists, and level 4 through a pilot, but it should not score 3 on evidence quality.
What documents should an AI recruiting software RFP ask for?
The seven in the evidence pack: a privacy or data protection impact assessment (or a summary), a sub-processor and data-location list, an independent security attestation with its scope, a breach notice clause, data processing terms, scoring documentation, and pilot results on your own data.
How do you score vendor responses to an RFP?
Separate pass-or-fail gates from weighted criteria. Treat each gate as met at level 2 or higher. For weighted criteria, rate each response from 0 to 4 on the evidence ladder and multiply the weight by the rating divided by 4. Claims alone score 1, written policies 2, independent evidence 3, and a pilot on your data 4.
How fast should a vendor tell us about a data breach?
Faster than your own clock, and in hours. Singapore requires notice to the PDPC no later than 3 calendar days after you assess a breach as notifiable. Indonesia requires written notice within 3 × 24 hours. Australia expects an assessment within 30 calendar days and notice as soon as practicable. New Zealand's Privacy Commissioner expects notice within 72 hours as a guide. Put a window in the contract that is shorter than the shortest clock you face, and agree who notifies.
Does a vendor have to tell us about a breach by law?
In Singapore, yes: a data intermediary must notify the organisation it processes data for without undue delay. Australia, New Zealand and Indonesia set no separate deadline for the vendor, so the contract has to. In New Zealand, what your vendor knows can count as what you know, so your clock can start before the vendor calls you.
Do we need our own privacy impact assessment if the vendor already has one?
Yes. The OAIC's guidance on commercially available AI products says a privacy by design approach includes a privacy impact assessment, and its PIA guide says your organisation stays responsible and accountable for personal information held by external service providers. The vendor's assessment is an input to yours. New Zealand's Privacy Commissioner publishes PIA guidance as well.
Can a long evidence pack guarantee a safe vendor?
No. Documents show what a vendor can prove today, not what will happen later. Certificates have scopes and dates, policies can drift from practice, and a pilot has a limited sample. That is why the ladder tops out at a pilot you run and re-check, and why no tool or vendor, including us, can certify compliance for you.