One isolated deployment per client

Each client's assistant runs as its own deployment on Cloudflare, with its own address, secrets, storage and release history. Assistants do not share database rows, storage keys or credentials. Which client a request belongs to is fixed by the deployment, never by anything the browser sends.

Roleline does not connect to your applicant tracking system. It holds no applications, no candidate profiles and no hiring records.

The data path for one question

  1. A visitor types a question on your careers site. It travels over TLS to your assistant on Cloudflare.
  2. Your assistant selects the relevant approved content and sends the question, recent conversation context and that content to Anthropic's API through Cloudflare AI Gateway. The gateway is configured not to log request or response content.
  3. Anthropic generates the answer. The answer streams back to the visitor through your assistant.
  4. If aggregate reporting is enabled for your assistant, a bounded excerpt of the exchange is sent to a classifier running on Cloudflare Workers AI, which returns fixed topic and outcome categories. Only those categories are kept. Cloudflare states that it does not use Workers AI inputs or outputs to train models.

What is stored, and for how long

  • Approved content. Each version of your content and configuration is stored as an immutable, digest-verified release in private storage, so the version you approved is the version that runs.
  • Conversation state. In standard configuration an assistant keeps the state of a conversation so it can continue, and deletes it seven days after the conversation starts. Later activity does not extend that deadline. A zero-storage mode that keeps no conversation content on our side is available where a deployment needs it.
  • Provider recovery windows. Cloudflare's point-in-time recovery for the storage we use means data deleted from current state may remain restorable by Cloudflare for up to 30 days. We do not restore from it except to recover from a failure, and we do not describe deletion as irreversible within that window.
  • Model provider. Anthropic deletes API inputs and outputs within 30 days as standard and may not train on them. Zero data retention can be arranged for a deployment and is recorded in its order form.
  • Reporting. Analytics hold fixed categories, counts, timings and costs against a pseudonymous session identifier. They never hold the question, the answer, a name or an email address, and reports suppress small counts so an individual cannot be picked out.

Data minimisation by design

The assistant is configured not to ask for personal details, and visitors are told not to share them. Where an insight can be drawn from a question, the assistant emits only a fixed category, never the wording. Sensitive characteristics are neither invited nor inferred.

Access and change control

  • Administration sits behind Cloudflare Access with an identity provider, limited to named people. The application verifies the identity again on every request and checks that the person is authorised for that action.
  • Secrets are held in the platform's secret store, never in source code. Client-supplied credentials are additionally encrypted at the application level.
  • Every version of an assistant is tested and approved by the client as a specific release. Going live is a separate recorded decision, and the previous version is retained for rollback.
  • Production changes are made by named people through recorded workflows, not by hand.

Encryption

All traffic between the visitor, the assistant, the administration tools and our providers uses TLS. Cloudflare encrypts stored data at rest. Credentials that a client supplies to us are encrypted again with an application-held key before storage.

Incidents and vulnerabilities

If you believe you have found a security problem in Roleline, tell us at hello@simplethin.gs. We acknowledge reports promptly and will not take action against good-faith research. Clients are told about a personal data breach affecting their data within 24 hours of us becoming aware of it, as the data processing agreement sets out.

Certifications and insurance

Our current certification position and our professional indemnity and cyber insurance certificates are provided on request as part of a supplier review. We do not claim a certification on this page that we cannot evidence.

What we do not claim

  • We do not claim that generated answers are error-free. Review before release and monitoring afterwards are part of the service design.
  • We do not claim irreversible deletion inside a provider's recovery window.
  • We do not claim that this description proves the settings of any particular deployment. Your deployment record does that, and we walk through it with you before go-live.

Related documents: sub-processors, data processing agreement and the trust page, which describes the operating model in product terms.