What should I do now?

Firstly, breathe. We are going to talk you through the things you may wish to consider so that you can act responsibly in the best interests of your organisation and the candidate.

Important context: All decisions about next steps, escalation, and reporting sit with you as the data controller (responsible party under POPIA), in line with your own policies, legal duties, and professional advice. The examples in this guidance are illustrative only and are not operational instructions.

</aside>

New Hires vs Existing Employees what this guidance covers

This guidance applies in two situations:

New hires (pre-employment screening)

Use this guidance when you are screening a candidate during recruitment, and a Red Flag Report is returned. This may inform safer recruitment decisions alongside criminal record checks, reference checks, checks against the National Register for Sex Offenders (NRSO) where legally required or permitted (as required by the Criminal Law (Sexual Offences and Related Matters) Amendment Act 32 of 2007), and your recruitment policies in line with the Employment Equity Act 55 of 1998 and the Protection of Personal Information Act (POPIA).

Existing employees (routine or risk-based screening)

Use this guidance when you are screening an existing employee as part of routine safeguarding reviews linked to documented risk, role requirements, or regulatory expectation, role changes, or where concerns have been raised. A Red Flag Report should be treated as a safeguarding and HR matter, and handled proportionately, fairly, and in line with your internal policies, the Labour Relations Act 66 of 1995, the Employment Equity Act, the NRSO where legally required or permitted (where applicable under the Criminal Law (Sexual Offences and Related Matters) Amendment Act 32 of 2007), and POPIA requirements.

When a Red Flag is identified

Understanding a Red Flag Report

A Red Flag Report means that Safehire.ai has detected associated activity linked to an individual (either a candidate or an existing employee), which falls under one or more of the following risk categories:

The individual has actively posted in forums linked to child sexual abuse material, radicalisation, extremism, or hate speech.
Personal identifiers (email, phone, username) appear in databases linked to associated risk categories.
Searches or file server/website visits indicate clear engagement with harmful material. </aside>

This is what a Red Flag report will look like. The most important section is the analyst’s report. This is verified and written by a human and explains the detailed associations found.

Examples of actions you may consider

The actions below are illustrative only. You will decide what is right in the context of your own setting, policies, and advice. Before acting, check how these steps fit with your own safeguarding, conduct, and disciplinary policies.

Informing your safeguarding leads, such as your Designated Safeguarding Officer, HR Manager, or Compliance Officer.
Deciding who else needs to be aware of the findings, and keeping this on a strict need-to-know basis.
Taking time to verify and understand the findings so they are not misread or used unfairly.
Getting legal advice where helpful.
Following legislative guidance and considering whether to report to external authorities (for example, the South African Police Service (SAPS), the Department of Social Development, or relevant provincial child protection services), based on your own legal advice, safeguarding duties under the Children's Act 38 of 2005, and professional judgement. Any decision to report externally is made by you as the responsible party under POPIA. </aside>