Workforce intelligence that can survive a CISO review and a Works Council vote.
J.U.L.E.S. HR-OS™ is a governed people-analytics control plane built on the AperX epistemic hyperledger. We are a seed-stage, research-first, woman-owned company — so we do not ask you to trust a logo wall. We ask you to inspect the causal assumptions, the privacy budget, the proxy-leakage diagnostics, and the cryptographic sign-off path. Everything below is interactive and tiered by evidence strength.
Unqualified “−43% attrition” style headline claims were removed in v4.1. Those figures originated in controlled synthetic benchmarks and now appear only inside the tiered evidence register with their generation conditions.
Your view: CHRO & Talent Strategy
Talent, Rewards & People Ops
Two-stage CV debiasing, pay-equity calibration, cold-start-capable retention twin, k-anonymous employee listening.
Bonded HiTL & Write-Back
No recommendation executes without an Ed25519-signed HRBP approval bound to an AperX commitment hash.
Attestation, DP & Erasure
SOC 2 / ISO readiness, (ε,δ)-DP accounting, HSM salt-shredding, TEE joins, ZK fairness receipts.
We are seed-stage. Here is exactly what is attested and what is not.
A startup cannot honestly claim a completed SOC 2 Type II observation window on day one. This register separates implemented controls, audit-ready artefacts, and third-party attestations, and states the residual gap and owner for each.
Entity & small-business status
Woman-Owned Small Business- Legal entity
- Simon Global Resources Group · Michigan, USA · Detroit headquarters
- Designation
- Woman-Owned Small Business (WOSB) — self-representation; SBA certification in progress
- UEI (SAM.gov)
- Pending assignment — will be published here once issued
- CAGE code
- Pending assignment — will be published here once issued
- SAM.gov registration
- In progress
- NAICS (planned)
- 541511 · 541512 · 541715 · 518210 · 541690
We do not display placeholder identifiers as active. Government registration codes appear on this page only after assignment.
Evidence tier legend
Applies to every number on this pageControlled simulation. Synthetic workforce generator, fixed seed, published parameters. No client data. Not a forecast.
Implemented & internally backtested. Code path exists and is exercised on public or synthetic corpora out-of-time.
Client out-of-time pilot. Backtest on a customer's own historical hold-out under NDA. Available on request; not yet published.
Third-party attested. Signed by an independent auditor or accredited body. Currently limited — see gaps.
Six pillars, each with an explicit failure mode.
Every pillar states what it does, the metric it is judged on, and the condition under which it refuses to produce a recommendation.
Two-stage unbiased screening
Hard PII sharding followed by adversarial gradient reversal against prestige, geography, and career-gap proxies. Uniform k=4 exchangeable observer rubrics.
Retention & flight-risk radar
Workload, recovery, and review-bottleneck signals aggregated at pod level. Never individual message content. Cold-start capable via hierarchical priors.
Internal skills marketplace
Capability-adjacency matching for open requisitions. Employee opt-in governs visibility; hidden employees are excluded from recruiter search by construction.
Compensation equity calibration
Multivariate decomposition of pay variance against verified contribution hyperedges. Joins run inside a TEE so raw payroll never leaves the enclave.
Succession & hidden experts
Surfaces “quiet unblocking architects” from public review cadence and aggregated calendar load — never message bodies or keystrokes.
Safe-Harbor listening
Local Wasm stylometric scrub, k-anonymity pod rollup for small teams, and a hard quarterly (ε,δ)-DP budget that stops answering when exhausted.
Transparent HR value model
Every assumption is exposed and editable. Reduction factors are Tier 1 simulation parameters, not measured client outcomes. Replace them with your own pilot results before taking this to a budget committee.
This calculator deliberately ships with a “set reduction to 0%” control. A vendor model that cannot express its own null hypothesis is not a diligence artefact.
PII stripping is necessary. It is nowhere near sufficient.
Two live engines. Safe-Harbor demonstrates k-anonymity pod rollup and a finite differential-privacy budget. The vectorizer demonstrates a two-stage pipeline where a gradient-reversal adversary attacks the residual proxies that survive sharding.
Raw submission (ephemeral, local)
Wasm scrub · client-sideδ = 1e-6 · Gaussian mechanism · clip norm 1.0 · per-query cost ε 0.15 · resets each quarter
HRBP-actionable signal
SVID · pendingCandidate artefact stream
Uniform k=4Setting λ = 0 reproduces the v4.0 “PII-stripping only” behaviour. Watch the mutual-information column fail.
Proxy-leakage diagnostic
idleAn anti-surveillance guarantee, expressed as an allow-list.
“Quiet unblocking architects” and burnout alerts are only legitimate if the ingestion surface is bounded and inspectable. This manifest is the contract, enforced at the adapter. In EU tenants, ingestion is off by default until a co-determination agreement is countersigned.
Ingestion surface
Toggle the tenant regime to see what the adapter physically permits.
Legal basis mapping: aggregated calendar load and public review cadence are processed under legitimate interest with a documented balancing test; the Wasm pulse is explicit consent, revocable per employee, and is force-disabled under EU Works Council mode until the agreement schedules it.
Most mid-sized enterprises have two policy changes, not two hundred.
A causal engine that only works on rich telemetry is useless to a 1,000–5,000 person employer. v4.1 adds Hierarchical Empirical Bayes shrinkage toward a DP-protected consortium prior, and reports Rosenbaum sensitivity bounds (Γ) so you can see how much unmeasured confounding would flip the sign — instead of silently emitting BLANK().
Intervention & identification controls
Seven indices, one governed decision ledger.
Click a tile to inspect its trend. Click a decision row to open the bonded HiTL audit modal. Exports are flattened for Power BI / Snowflake and include the evidence tier of every metric.
| Proposal | N | Status |
|---|
Recall of regrettable-attrition events in a controlled synthetic workforce, 60 days before separation. Precision 0.61. False-positive cost is a real HRBP conversation.
Adverse-impact ratio is an enforced runtime invariant, not a marketing result. The circuit breaker freezes recommendations if any protected subgroup falls below 0.80×.
We have not yet published a client hold-out backtest. Prospective pilots run in shadow mode for 60 days against your own history before any recommendation is surfaced.
Org charts cannot represent who actually unblocked the work.
AperX models four edge classes. Click any vertex to simulate a departure and watch skill saturation σ_d recompute — the bus-factor instrument behind succession planning.
Directed · attribution
σ_d = |E_d| / C(n_d,k). Complete-class saturation is the formal measure of how much of a capability domain is already cross-trained.
Reading is easy. Writing back is where liability lives.
Four query surfaces plus a fifth tab showing the only path by which J.U.L.E.S. can change a system of record: a structured approval card, cryptographically signed by a bonded HRBP, bound to an AperX commitment hash.
Bonded approval card
AWAITING SIGNATURESignature scheme: Ed25519 over the canonical JSON of the proposal, with the AperX commitment hash as a bound field. Replay is prevented by a monotonic nonce and a 15-minute expiry.
From an HR signal to a board-level invariant.
Click a domain to load its formal invariant, its telemetry shape, and to seed the retention twin with the matching intervention.
Organizational digital twin
Advanced capabilities, labelled by maturity — not by ambition.
For forward-looking CISOs and Chief People Scientists. Each module states its build status: implemented, reference implementation, or research prototype. Simulators demonstrate the verification flow, not a production cryptographic guarantee.
10.1 · Zero-knowledge fairness attestation
A regulator or Works Council auditor verifies that a slate satisfied AIR ≥ 0.80 and PII_Sharded = TRUE without receiving a single résumé, capability vector, or model weight.
Private witness (never revealed): individual résumés, capability embeddings, observer identities, proprietary rubric weights. The Halo2 circuit is not yet production-audited.
10.2 · GDPR Art. 17 cryptographic salt-shredding
An immutable ledger and a right to erasure appear contradictory. They are not, if the ledger stores only salted vertex commitments and the salt lives in a customer-managed HSM key.
10.3 · Confidential computing for cross-silo joins
Payroll and collaboration metadata are joined inside a hardware-isolated enclave. Neither cloud administrators nor Simon Global engineers can observe raw employee records.
Production availability is gated on customer VPC deployment. In the shared-service tier, cross-silo joins are disabled rather than downgraded.
10.4 · Employee-owned digital twin co-pilot
Organisational analytics without employee agency is surveillance with better maths. Opt-in lets an individual inspect their own capability hyperedges and simulate their own corridors.
Self-service view is currently disabled in this demo. Toggle it on to inspect the employee-side surface.
10.5 · Regulatory drift watchdog & governance circuit breaker
A rolling 30-day monitor on selection-rate parity and causal calibration. If any protected subgroup drops below 0.80× AIR, recommendations freeze and the CISO/CHRO are notified.
A fair comparison, and an honest “do not buy us” list.
Below is a capability-framing comparison and a decision guide. Competitor roadmaps move quickly; treat this as a positioning framework, not a feature audit, and validate against current vendor documentation.
| Capability dimension | J.U.L.E.S. HR-OS™ v4.1 | Enterprise HCM suites Workday Illuminate · Peakon · SAP | People analytics & talent AI Visier · Eightfold AI |
|---|---|---|---|
| System of record | Not a system of record. Overlay only. | Native, deep, payroll-grade | Partial; typically relies on HCM |
| Causal identification & sensitivity | Empirical-Bayes shrinkage + Rosenbaum Γ per estimate | Predominantly descriptive & predictive | Predictive matching; causal claims vary |
| Cold-start behaviour | Explicit prior-dominated regime with labelled tier | Requires historical volume | Requires historical volume |
| Proxy-bias adversarial testing | Gradient reversal + published MI diagnostic | Bias dashboards; adversarial testing not typical | Vendor bias audits; method disclosure varies |
| Formal DP budget accounting | Per-quarter (ε,δ) ledger with hard stop | Not typical | Not typical |
| Cryptographic decision lineage | AperX commitments + Ed25519 HiTL write-back | Audit logs, not cryptographic replay | Audit logs, not cryptographic replay |
| Works Council co-determination tooling | Adapter-level allow-list + EU default-off | Mature regional compliance programmes | Regional configuration |
| Third-party assurance maturity | Seed stage · SOC 2 / LL144 in progress | Established, multi-year attestations | Established attestations |
| Deployment & change cost | Overlay pilot; low footprint, new-vendor risk | High; suite-wide transformation | Moderate; integration-heavy |
Overlay J.U.L.E.S. when…
- You already run Workday / SuccessFactors and do not want a replacement programme.
- You are 1,000–5,000 employees with sparse policy history and need cold-start-honest causal estimates.
- A Works Council, regulator, or plaintiff's counsel will ask you to replay a specific promotion or selection decision.
- You need formal DP accounting and k-anonymity for employee listening, not just an anonymity promise.
- You want an adversarial proxy-bias diagnostic you can hand to an independent auditor.
Native HCM suffices when…
- Your question is descriptive: headcount, turnover, span of control, comp ratios. Your suite already answers it.
- You have no governance requirement for cryptographic replay or third-party bias attestation.
- Your procurement policy cannot onboard a seed-stage vendor with an open SOC 2 observation window.
- You lack an HRBP owner with capacity to sign governed write-backs — the HiTL requirement becomes a bottleneck, not a safeguard.
- You need payroll, benefits, or time tracking. We do not do those, and we will say so in the first call.
“Human Resources should never merely administrate policy — it should architect human potential. But it must do so with worker privacy, mathematically unbiased evaluation, and counterfactual humility, or it is simply surveillance with better vocabulary.”
We are an interdisciplinary team of subject-matter experts and researchers spanning machine learning and causal inference, industrial–organisational psychology, labour economics, cryptography and privacy engineering, and people operations. We publish methodology notes alongside the product.
Four-fifths testing as a runtime invariant with a tripping circuit breaker, not an annual report.
High-risk employment documentation pack: intended purpose, risk management, data governance, human oversight, logging.
Adapter allow-list, EU default-off ingestion, Art. 17 salt-shredding, DP budget ledger.
Independent bias-audit template and candidate-notice flow ready; auditor engagement pending.
Ask us the hard question first.
We take a limited number of shadow-mode pilots per quarter. Bring your CISO and your Works Council chair to the first call — we would rather lose a deal in week one than in month nine.
All NDA requests, mutual-NDA executions, and diligence-pack artefacts are routed to nda@simonglobal.io.