One core · Multiple companies · Infinite portals
The Intelligent Recruitment Operating System.
Most hiring software is one company’s tool, sold many times over. METIS is one platform, lived in by many companies — each sealed from the next, each on its own domain, under its own brand, running its own pipeline.
The premise
Give every company a copy of the software and you get a hundred codebases drifting apart. Give them all the same one and you get a hundred companies reading each other’s candidates.
METIS is the third answer.
One core, and isolation enforced so far down that a mistake in a page cannot leak a row. Build the engine once; hand out sealed environments forever.
4
Architectural layers
17
Data models
15
Granular permissions
1
Codebase, every tenant
Architecture
Candidate and recruiter surfaces built to the standard of a consumer product. Nobody has ever enjoyed filling in a careers form. That is a design failure, not a law of nature.
Jobs, applications, candidates, screening, interviews, offers. One pipeline, configurable per company, and every movement through it accounted for.
Parsing, summaries, matching and search — every output validated against a schema before it touches your data, and every score carrying the evidence behind it.
Tenancy, roles, branding, analytics, security. The layer that makes the five-hundredth company cost the same to serve as the first.
Multi-tenancy
Onboarding takes a form. The tenant, its seven-stage pipeline, its domain and its first administrator are created in one transaction — and the new company is live before the form finishes submitting.
METIS
│
├── Company A
careers.company-a.com
jobs · candidates · interviews · analytics
│
├── Company B
careers.company-b.com
jobs · candidates · interviews · analytics
│
└── Company C
company-c.metis.dev
jobs · candidates · interviews · analytics
The engine
Stages are per-company. Moves are drag-and-drop, keyboard-operable, and every one of them lands in the audit trail with who moved whom, from where, and when.
Intelligence
A number with no reasoning behind it is not intelligence, it is a guess with a percentage sign. Every METIS score arrives with the evidence that produced it, and every field a CV never stated comes back empty rather than invented.
The model is never given authority either. Natural-language search produces filter values — never a query — and those run through exactly the same tenant-scoped client as everything else. A prompt buried in a CV cannot widen a search.
Senior React Engineer
82% matchAdvisory only. METIS records assessments; people make decisions.
Security
Multi-tenancy fails quietly. One forgotten filter in one query and a company reads a competitor’s pipeline. So the filter is not something anyone remembers to write.
Every query on tenant-owned data passes through one function that merges the tenant filter in last. A caller-supplied id cannot widen it. Eleven tests attack that boundary on every run — forged ids, OR-clause smuggling, broad deletes.
Ask for another company’s candidate and METIS says the page does not exist. It will not confirm that the record is real and merely out of reach.
CVs live in a private bucket under unguessable, tenant-namespaced keys. Access is a five-minute signed URL issued only after an authorization check, and every download is audited.
Audit events are append-only by construction: there is no update or delete path anywhere in the codebase. Even a platform operator entering a company is written into that company’s own record.
The candidate
Finds the role on your own domain, under your own brand.
Name, email, CV. Three fields, no account to create.
The CV is parsed into a structured profile within seconds.
Matched against the role, with the reasoning attached.
Offered real slots, not a request to “find a time”.
By people, with the evidence in front of them.
Plans
One team, first hires.
Hiring is now somebody’s whole job.
Many brands, one platform.
Plans and seat limits are set per company from the METIS command centre. Metering and invoicing are not implemented yet.
Questions
One. A company is a row, not a deployment. Onboarding takes a form: the tenant, its pipeline, its domain and its first administrator, created in a single transaction. No branch, no build, no release.
Not through any path in the application. Tenant scope is derived from your own membership rows, merged into every query last, and enforced again by role. The isolation suite runs against a real database and attacks that boundary directly.
No, and it is built so it cannot. It extracts, summarises and scores — always with the evidence attached, and always returning “unknown” where a CV is silent rather than inventing a gap. Decisions stay with people.
The interface says so. CVs are still stored, search falls back to plain text matching, and nothing is fabricated to fill the gap. The same is true of document storage.
Yes. Point a CNAME at METIS and verify the hostname. Until it is verified it resolves to nothing, so nobody can serve a portal under a name they do not control.