At apply: passive signals
Every application is scored on signals the candidate never sees, with no extra step for them.
What is looked at
- Network: VPN, hosting provider and Tor addresses, matched against lists bundled with Elsin, and access from a sanctioned region.
- Location: the country, timezone and phone country compared with where the candidate says they are.
- Contact: throwaway email domains, and the same phone, email or device used by other people.
- How the form was filled in: impossible speed, a hidden trap field, and signs of a script. Only summary numbers are kept, never keystrokes, typed text or mouse positions.
- Résumé and profile: résumé text or file reused by another applicant, a photo used by someone else, a shared LinkedIn profile, GitHub and website checks, and dates that do not add up.
- Employers named on the résumé: a company domain that is not registered, or was registered over a year after the job supposedly started.
How the score works
Each signal has a weight. The weights add up to a score from 0 to 100. Signals that see the same fact are folded together so one fact is not counted twice: a VPN and a hosting address count once, as the stronger of the two.
A score under 25 shows as Low risk. A score at or above your review threshold sends the candidate to review. The review risk threshold is 60 for a new workspace and can be changed in Settings, under Trust policy. Changing it rescores the candidates it affects.
Some signals send a candidate to review on their own, whatever the score: an ID already verified under another name or on another account, and access from a sanctioned region. The full list is in risk signals.
Phone line type
Elsin reads the phone number's numbering plan for free. That spots toll-free, premium and some VoIP numbers, but cannot tell a VoIP number in the US or Canada from a mobile. A carrier lookup through Twilio is built but switched off, so reviewers see the result described as coming from the numbering plan.
Rescoring
The score is recomputed as more is learned: after later checks, when the network changes between steps, and after a reviewer's decision. A reason a reviewer has cleared is not counted again for that candidate.