Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.encoreos.io/llms.txt

Use this file to discover all available pages before exploring further.

Version: 1.0.0
Last Updated: 2026-02-10
Status: Active
Module: HR
Cross-References:

​
Overview

This document defines the mandatory compliance requirements and sign-off gates that must be satisfied before enabling Background Check (Checkr) and SMS notification features in production. Each gate requires documented approval from the designated authority before the feature can be activated for an organization.

​
Current Verification Status (2026-03-03)

AreaImplementationSign-OffTarget
F-01–F-12 (FCRA)Spec and DB/RLS in place (HR-09-P5.2); Checkr live integration not yet enabled. Tables: hr_background_checks, hr_background_check_webhook_audit.All ☐ PendingGate 1 target: when HR-09-P5.2 ships (Q2 2026)
T-01–T-12 (TCPA)Spec and DB/RLS in place; hr_sms_consent_logs, consent types, PHI detection pattern. SMS delivery via existing send-sms-notification edge function.All ☐ PendingGate 2 target: when SMS feature enabled for orgs (Q2 2026)
Pre-requisite for Gate 1: HR-09-P5.2 (Background Check Integration) must be implemented and deployed before Checkr can be enabled for any organization. Until then, all F-* requirements remain “implementation ready, sign-off pending.”

​
1. FCRA Compliance Requirements (Background Checks)

The Fair Credit Reporting Act (FCRA) governs how consumer reports (background checks) are obtained, used, and disclosed in employment decisions.

​
1.1 Pre-Screening Requirements

#RequirementImplementationStatusSign-Off
F-01Written Disclosure — Provide applicant a standalone written disclosure that a background check may be obtainedfcra_disclosure_document_url field on hr_background_checks☐ Pending________
F-02Written Authorization — Obtain written consent from the applicant before ordering the reportConsent captured via Candidate Portal (HR-09-P5 Phase 5.3) with timestamped record☐ Pending________
F-03Certification to CRA — Certify to the Consumer Reporting Agency (Checkr) that all FCRA requirements have been metCheckr API invitation flow includes employer certification☐ Pending________
F-04State-Specific Disclosures — Include any state-specific disclosure addenda (e.g., CA, NY, WA)Organization-level document configuration in settings☐ Pending________

​
1.2 Adverse Action Process

The FCRA mandates a two-step adverse action process when a background check result may negatively impact an employment decision.
#RequirementImplementationStatusSign-Off
F-05Pre-Adverse Action Notice — Send the applicant a copy of the report, a summary of rights, and a pre-adverse action letter before making a final decisionadverse_action_notice_sent_at + adverse_action_notice_document_url fields; FCRAAdverseActionStatus = 'notice_sent'☐ Pending________
F-06Waiting Period — Allow a reasonable waiting period (typically 5 business days) for the applicant to disputedispute_window_closes_at field with configurable window; system blocks final action until window expires☐ Pending________
F-07Dispute Handling — Process applicant disputes by re-investigating through the CRAdispute_submitted, dispute_reason, dispute_resolved_at fields; FCRAAdverseActionStatus = 'dispute_pending' → 'resolved'☐ Pending________
F-08Final Adverse Action Notice — If decision stands after dispute window, send final adverse action notice with CRA contact info and rights summaryfinal_adverse_notice_sent_at + final_adverse_notice_document_url; FCRAAdverseActionStatus = 'final_notice_sent'☐ Pending________
F-09Record Retention — Retain all FCRA-related documents per federal (1 year) and state requirementsfcra_retention_until field; retention policy enforcement☐ Pending________

​
1.3 Ongoing Obligations

#RequirementImplementationStatusSign-Off
F-10Data Security — Properly dispose of consumer report informationSoft-delete with fcra_retention_until expiration; no PII in logs☐ Pending________
F-11Audit Trail — Maintain complete audit trail of all background check actionshr_background_check_webhook_audit table; immutable webhook logs☐ Pending________
F-12Permissible Purpose — Only obtain reports for permissible employment purposesApplication-level enforcement: checks tied to hr_applications with active status☐ Pending________

​
2. TCPA Compliance Requirements (SMS)

The Telephone Consumer Protection Act (TCPA) regulates automated text messages and requires explicit consent before sending SMS communications.
#RequirementImplementationStatusSign-Off
T-01Express Written Consent — Obtain clear, conspicuous written consent before sending any automated SMShr_sms_consent_logs table with consent_given, consent_text, ip_address fields☐ Pending________
T-02Consent Text Disclosure — Consent language must clearly describe the types of messages, frequency, and data ratesDEFAULT_CONSENT_TEXT constant; customizable per organization☐ Pending________
T-03Consent Per Message Type — Separate consent for each category of messagesSMSConsentType enum: background_check_notifications, interview_reminders, offer_updates, general_hr☐ Pending________
T-04Voluntary Consent — Consent cannot be a condition of employment or applicationUI displays consent as optional checkbox; application proceeds regardless☐ Pending________

​
2.2 Opt-Out Mechanisms

#RequirementImplementationStatusSign-Off
T-05STOP Keyword — Honor “STOP” replies to immediately cease messagesopt_out_methods: 'stop_keyword'; webhook processing for inbound STOP☐ Pending________
T-06Opt-Out Confirmation — Send a single confirmation message acknowledging opt-outEdge function sends one final message upon STOP processing☐ Pending________
T-07Opt-Out Record — Maintain timestamped record of all opt-outsopted_out_at, opt_out_method fields on hr_sms_consent_logs☐ Pending________
T-08Re-Opt-In Process — If user texts START after opting out, re-enable with fresh consentNew consent log entry created; previous opt-out record preserved☐ Pending________

​
2.3 Message Content Requirements

#RequirementImplementationStatusSign-Off
T-09Organization Identification — Every message must identify the sending organizationMessage templates include org name prefix☐ Pending________
T-10Opt-Out Instructions — Every message must include opt-out instructionsSMS footer includes “Reply STOP to opt out”☐ Pending________
T-11No PHI in SMS — Messages must not contain Protected Health InformationPHI detection via detectPhiInMessage utility; sms_phi_detection_mode setting☐ Pending________
T-12Business Hours — Send messages only during appropriate hourssms_business_hours_start/end in ce_module_settings☐ Pending________

​
3. Sign-Off Gates

​
Gate 1: Background Check Feature Activation

Required before: Enabling Checkr integration for any organization
Target date for sign-off: Q2 2026 (when HR-09-P5.2 ships)
PrerequisiteAuthorityDateSignature
All F-01 through F-04 requirements verifiedCompliance OfficerYYYY-MM-DD______________
Adverse action workflow tested end-to-end (F-05 through F-08)Legal CounselYYYY-MM-DD______________
Audit trail and retention policies confirmed (F-09 through F-12)Data Privacy OfficerYYYY-MM-DD______________
Checkr webhook signature verification testedEngineering LeadYYYY-MM-DD______________
State-specific disclosure review for operating statesLegal CounselYYYY-MM-DD______________
Gate Decision: ☐ Approved / ☐ Conditional / ☐ Blocked Conditions (if any): _______________________________________________

​
Gate 2: SMS Feature Activation

Required before: Enabling SMS notifications for any organization
Target date for sign-off: Q2 2026 (when SMS feature enabled for orgs)
PrerequisiteAuthorityDateSignature
All T-01 through T-04 consent mechanisms verifiedCompliance OfficerYYYY-MM-DD______________
Opt-out flow tested end-to-end (T-05 through T-08)Legal CounselYYYY-MM-DD______________
Message content requirements validated (T-09 through T-12)Compliance OfficerYYYY-MM-DD______________
PHI detection rules reviewed and testedData Privacy OfficerYYYY-MM-DD______________
Carrier registration (10DLC/A2P) completedEngineering LeadYYYY-MM-DD______________
Gate Decision: ☐ Approved / ☐ Conditional / ☐ Blocked Conditions (if any): _______________________________________________

​
Gate 3: Per-Organization Activation

Required before: Enabling features for each new organization/tenant
PrerequisiteAuthorityDateSignature
Organization-specific disclosure documents uploadedOrg AdminYYYY-MM-DD______________
State-specific addenda configured for org’s operating statesCompliance OfficerYYYY-MM-DD______________
SMS consent text reviewed and customizedLegal CounselYYYY-MM-DD______________
Org admin trained on adverse action workflowCompliance OfficerYYYY-MM-DD______________
Gate Decision: ☐ Approved / ☐ Conditional / ☐ Blocked

​
4. Enforcement in Code

The following technical controls enforce compliance gates:
ControlLocationDescription
HiringChecklist componentHR-09-P5Blocks hire completion until background check is complete_clear and offer is signed
SMS consent gatehr_sms_consent_logsSMS sending functions verify active consent before dispatch
PHI detectiondetectPhiInMessageBlocks or warns on PHI content based on sms_phi_detection_mode
Adverse action state machineFCRAAdverseActionStatusEnforces sequential progression: none → notice_sent → dispute_pending → resolved → final_notice_sent
Webhook audit immutabilityhr_background_check_webhook_auditRLS restricts writes to service_role only
Consent record immutabilityhr_sms_consent_logsInsert-only policy; no updates or deletes by application users

​
5. Periodic Review Schedule

ReviewFrequencyNext DueOwner
FCRA process auditQuarterlyYYYY-MM-DDCompliance Officer
TCPA consent mechanism reviewQuarterlyYYYY-MM-DDLegal Counsel
State law update checkMonthlyYYYY-MM-DDLegal Counsel
PHI detection pattern updateSemi-annuallyYYYY-MM-DDData Privacy Officer
Carrier compliance review (10DLC)AnnuallyYYYY-MM-DDEngineering Lead

​
Official Sources

SourceURL
FTC: Using Consumer Reports — What Employers Need to Knowhttps://www.ftc.gov/business-guidance/resources/using-consumer-reports-what-employers-need-know
CFPB: Summary of Consumer Rights (FCRA Regulation V, Appendix K)https://www.consumerfinance.gov/rules-policy/regulations/1022/K
FCC: Rules and Regulations Implementing the TCPAhttps://www.fcc.gov/document/rules-and-regulations-implementing-telephone-consumer-protection-act-22
Full list of authoritative external references (HR, CL, PM, RH, GR, IT, PF): root AGENTS.md § Authoritative External References.

​
Version History

​
1.0.0 (2026-02-10)

  • Initial compliance tracking document
  • Defined FCRA requirements F-01 through F-12
  • Defined TCPA requirements T-01 through T-12
  • Established three sign-off gates (feature activation, SMS activation, per-org activation)
  • Mapped enforcement controls to codebase
Last Updated: 2026-02-10
Next Review: 2026-05-10