Assessment vendors usually treat compliance as paperwork bolted on at procurement. Equilibrium was built the other way round: the consent record, the audit log and the bias audit are product surfaces your team uses, not documents we email you.
Compliance centre
Every consent is purpose-specific, versioned to the exact text shown, and timestamped. Revocation is a first-class action: it stops future processing and flags the aggregates the person contributed to.
Append-only logging of every score-affecting event and every report view: who, when, which norm version, which item parameters, which export. Customers export the whole trail as CSV or JSON, it is your record, not ours.
Optional, separately consented self-ID stored in a segregated table with tightened access. Per-construct distributions and impact ratios across groups and intersections, using both the four-fifths rule and a 2-SD test, exported as a dated audit artefact.
Any org-side view that could inform a decision requires a named reviewer and a written rationale before it can be exported. Reviewers whose median review time falls under ten seconds are flagged as rubber-stamping.
Per-region compliance modes (NYC, IL, TX, CA, CO, EU) switch on the matching templates: pre-use disclosure, adverse-outcome notice workflow, and a dispute and data-correction queue with a 30-day SLA tracker.
Subject-access export in a machine-readable, portability-shaped format. Deletion runs two ways: organisation data is removed by crypto-shredding, which destroys the subject key rather than rewrite an append-only log, and an individual consumer's data is deleted from the database on a verified request within 7 days. Retention periods are applied by a daily job, configurable per region.
Data handling