Reference check notes and AI confidentiality: what a referee call gives away in ChatGPT or Claude.

A reference check is a candid conversation with someone who knew the candidate at work, and the recruiter’s notes keep it: a warning issued years ago, how a role ended, a remark about someone’s health, what they were paid and the comment the referee asked not to be repeated. Consultants paste those notes into ChatGPT or Claude to turn them into a polished report for the client. This page marks every item in a routine set of reference notes that the Privacy Act touches, including health information, and shows how the same report is written on Ermos inside the agency.

The reference check notes

Taken by phone after a client is interested, usually with the candidate’s written consent, and written up the same day. The notes become the reference report that goes to the client with the agency’s rating.

Reference check
Candidate: · Finance Manager, Northgate Freight Solutions · Taken by TH, 30 October 2026, 9.40am, 22 minutes

Referee.

Performance.

Why she left.

2021.

Pay.

Off the record.

My assessment.

Second referee.

An invented set of reference notes. All people and companies are fictional. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the agency

  1. 1
    The candidate

    A named person whose references are being taken. Everything below ties to her. Privacy Act guide.

  2. 2
    The referee and the consent

    A second person’s name, title and employer, and a record that the candidate consented. Personal information about the referee, and the evidence the agency relies on for taking the reference. Privacy Act guide.

  3. 3
    A written warning

    A disciplinary record from 2019. Personal information about the candidate, given by a former manager. If the agency holds it, it is collected and held under the APPs, because the OAIC says the employee records exemption will not cover personal information about prospective employees. Privacy Act guide.

  4. 4
    A redundancy and an executive’s decision

    How the candidate’s last role ended, a payout figure and a named chief executive’s plan to outsource payroll. The former employer’s confidential business, and the candidate’s personal information.

  5. 5
    A health remark and stress leave

    A referee’s view that the candidate was close to burnout, with leave taken. Information about a person’s health is sensitive information, collected here from a third party. APP 3 applies higher standards to sensitive information. Patient data guide.

  6. 6
    Pay in the last role

    A past salary and bonus. Personal information that also reveals what the candidate is likely to accept. Privacy Act guide.

  7. 7
    The off-the-record comment

    An opinion about a named executive that the referee asked not to be repeated. A confidence the referee gave the consultant on one condition.

  8. 8
    The consultant’s rating and questions

    The agency’s assessment, and a question about the candidate’s stamina that edges toward her health and family plans. A candidate can ask for access to what the agency holds about her, and APP 12 requires access unless an exception applies. Privacy Act guide.

  9. 9
    A decision about contacting the current employer

    That the candidate’s employer does not know she is looking and must not be called yet. It reveals the job search, and an accidental contact could cost her the job.

What happens in Frontier Models (ChatGPT, Claude)

  • The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
  • On consumer tiers, prompts can be retained and used to train future models.
  • The provider’s staff and systems can reach the content under the provider’s own policies.
  • Once sent, the agency no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the candidate file. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

Frontier Models (ChatGPT, Claude)Ermos EdgeErmos Dominion
Where the document is processedProvider servers, generally offshore on personal plansYour instance in an Australian data centre; answers generated in AustraliaThe unit in your office
Who can read itProvider staff and systems, under policyYour staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothingYour staff only
Is it keptOn the provider’s termsKept on your instance; the provider is barred from retaining itStays on the unit
Can it train a modelOn consumer tiers, yesNo, by contractOnly your own unit learns from it, on your hardware

Part of AI data leakage in recruitment agencies.

Common questions

Do ChatGPT and Claude use the information in reference check notes?
Yes, everything pasted or uploaded is sent to the AI company's servers and processed there to produce a reply. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. Reference notes hold a written warning from 2019, a redundancy with a payout of about $48,000 and a referee's remark about stress leave.
Is it safe to paste reference check notes into ChatGPT or Claude if we remove the candidate's name?
No, because the referee and the events still identify her. Removing names rarely makes a document anonymous. Information stays personal information while the person is reasonably identifiable, and the OAIC warns that information can be at risk of re-identification even when it has been de-identified or anonymised. A named Group Controller at Pinegrove Foods, a restructure in August 2021 and a warning in 2019 describe one career. The referee also asked that one comment about a named executive not be repeated. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks.
Can ChatGPT or Claude be trusted to draft a reference check report?
Not without a check. Language models can produce fluent text with details that are not in the source, wrong figures, wrong dates or references that look real but are not. A qualified person should check every item against the call notes. In these notes the 2019 warning, the reason the role ended and the health remark would do most harm if softened, hardened or wrong.
How can a recruitment agency use AI for a reference check report without sending it to ChatGPT or Claude?
Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. Ermos drafts the report from the consultant's call notes and the agency's own report template. The consultant checks it against the call and signs it before it reaches a client.
Can a candidate see our reference check notes?
APP 12 requires an APP entity to give an individual access to the personal information it holds about them on request, unless a specific exception applies. Reference notes about a candidate are personal information about her, so write them on the assumption that she may read them, and take advice before refusing access.
A referee mentioned the candidate's health. Should it be in the report?
Health information is sensitive information, and APP 3 applies higher standards to its collection. A referee's remark about burnout or stress leave is rarely something the role needs. The safer practice is to record only what bears on the job and leave the rest out of the notes and the client report.
Does an AI summary of reference notes create a risk beyond privacy?
Yes, accuracy. The OAIC's AI guidance names APP 10 on accuracy and uses candidate screening as an example, and a summary can harden a referee's careful phrasing into a flat statement about the candidate. Whoever drafts the report, the consultant should check it against the call before it reaches a client.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo
Keep reading
AI data leakage in recruitment agencies Resources The Privacy Act, the APPs and AI All professions