REST API and webhooks
One API for criminal record, identity, reference, employment and education checks. Webhooks fire on every status change, and a sandbox is included with sign-up.
Background screening API
For tech companies, MSPs and security teams
IT and cybersecurity background checks, before you hand over the keys
Confirm the remote candidate is a real person who matches their ID, then check their criminal record, education, past employers and references. Canadian criminal results in about 15 minutes, each with a timestamped record for your next audit.
Pay per check, no subscription. REST API and webhooks included.
★★★★★ 5.0 on Google
★★★★★ 4.9 on G2
100% Canadian owned and operated
Data hosted in Canada
- ~15 min
- Canadian criminal record checks
- 13,500+
- ID document types, with liveness
- 225
- International jurisdictions, priced upfront
- $0
- No subscription, no minimum
Identity verifiedLiveness passed
R. Mehta · Senior DevOps engineer
Passport matched to a live selfie. Decision returned in seconds.
Sent to human review
Video came through a virtual camera
Injected media detected on a backend developer applicant. Nothing else runs until it's resolved.
Screening complete
Cleared Oct 14, 9:42 a.m.
Criminal record, education and two references. Logged before the access request was approved.
Remote hiring fraud
Who's actually on the other end of the video call?
In July 2025, the RCMP, Public Safety Canada, Global Affairs Canada, FINTRAC and the Canadian Centre for Cyber Security warned Canadian businesses about North Korean IT workers posing as freelancers and remote hires. Gartner predicts that by 2028, 1 in 4 candidate profiles worldwide could be fake. Here are the red flags the Canadian advisory lists, and the check that answers each one.
| Red flag in the advisory | What to check | On Credibled |
|---|---|---|
| Deepfake technology used during meetings | That a live person matches the ID, on a real camera | ID verification with passive liveness and injected-media detection |
| Slow or missing identification documents | A government ID, checked for forgery | Document authenticity checks on 13,500+ ID types; the candidate's part takes under a minute |
| Inconsistent education history | The credential, confirmed with the school itself | Education verification with the issuing institution, in Canada or abroad |
| Inconsistent work history | Titles and dates, confirmed with past employers | Employment verification, wherever the employer is |
| Background and references not yet checked | References that come from real, independent people | Reference checks that flag a shared device, network or personal email |
| Claims to be based in another country | Criminal records where they actually lived | International criminal record checks, 225 jurisdictions priced upfront |
Sources: RCMP advisory on North Korean IT workers (July 2025) and HR Dive on Gartner's 2025 candidate fraud research. The advisory also lists payment and login red flags that a background check doesn't cover.
Identity verification
Built for candidates you'll never meet in person
Many tech teams now ship a laptop, create accounts and add someone to payroll without ever being in the same room. Identity verification runs first, so every other check is about the right person.
- Passive liveness. Confirms a real person was on camera, not a printed photo, screen replay, mask or generated image. No blinking or nodding on cue.
- Injected media detection. Catches synthetic video fed through a virtual camera or an emulator.
- Document authenticity and face match. The ID is checked for tampering, then matched to the selfie.
- Human review. Sessions the automation can't settle go to a person, not to an automatic pass.
Identity verification · 4 signals
In review
Applicant 2817 · Backend developer
- Document authenticity · Passed
- Face match to ID photo · Passed
- Liveness · Passed
- Camera source · Virtual camera detected
Injected media
The video stream came from software, not a device camera. A reviewer will look at the session before a decision is returned.
Criminal record, education and reference checks wait until identity is confirmed.
SOC 2 and ISO 27001
Screening evidence your auditor can sample
ISO 27001:2022 control A.6.1 asks for background verification checks on candidates before they join, proportional to the information they'll access and the risks. SOC 2 doesn't name background checks, but auditors commonly test personnel screening when they sample new hires.
Either way, the questions are similar: was the check done, when, with consent, and before access was granted?
- A record per hire. Each check, its result and its completion date, in one place.
- Consent on file. Collected in the candidate flow and kept in the audit trail.
- Who ordered it and when. Every order is logged against the team member who placed it.
- Timestamps to compare. Line up completion dates with your access-provisioning tickets.
Hire to access, in order
- OfferConditional on screening, per your policy.
- ConsentSigned by the candidate, timestamped.
- IdentityID and live selfie, before anything else runs.
- Checks completeCriminal record, education, employment, references.
- Access grantedAfter the completion date, which is what auditors check.
By role
Proportional to the access, as ISO 27001 asks
A help desk technician and a cloud administrator shouldn't get the same screening. A common way to tier it:
| Role | Common checks |
|---|---|
| Privileged access: cloud and system admins, DevOps, SRE, database admins | Criminal record with ID, employment and education verification, references, credit check where the role can move money or change payment systems |
| Security: SOC analysts, penetration testers, incident response | Criminal record with ID, employment and education verification, credential verification, references |
| Software engineers and data roles | Criminal record with ID, employment and education verification, references |
| Help desk, desktop support, field technicians | Criminal record with ID, references |
| MSP staff with client environment access | Criminal record with ID, employment verification, references, plus anything your client contracts require |
| Contractors and freelancers | ID verification, criminal record, references; international checks where they live outside Canada |
| Federal government contracts | Security clearances such as reliability status are granted by the government's Contract Security Program, not by a screening company |
Employment credit checks on Credibled are a soft inquiry, so the candidate's score isn't affected. Control text from ISO 27001:2022 Annex A 6.1. Requirements vary by province and by contract; this is general information, not legal advice.
Fits how tech teams hire
Order from the dashboard, the API or your ATS
IT staffing and recruiters
Order checks from Bullhorn, JobAdder or Vincere, and stop a second recruiter paying to screen the same candidate.
For staffing agenciesCanadian startups
Under 5 years old with fewer than 25 employees? Reference checks are free for your first 6 months, and other checks are discounted. Select Startup at sign-up.
Startup programPay per check
Priced per hire, not per seat
Hiring comes in waves. Pay per check, with no subscription, no minimum and no contract. Canadian criminal record checks carry no access fee, and international prices are published by jurisdiction before you order.
Your exact prices appear during sign-up. Creating an account is free, with no credit card.
Security
Candidate data, kept in Canada
Hosted on AWS in Canada (Central), encrypted in transit and at rest, PIPEDA compliant, with role-based access and logged production access. Breaches involving your data are notified within 72 hours.
Straight answers
What we don't do, so you can plan around it
We don't monitor after the hire.
A check is a snapshot on the day it runs. ISO 27001 expects screening on an ongoing basis, so re-screen privileged roles on a schedule you set.
We don't grant security clearances.
Reliability status and Secret clearances for federal contracts come from the government's Contract Security Program. We can screen your staff; we can't clear them.
We're not SOC 2 certified yet.
We're working toward SOC 2. Our controls are published in the Trust & Security Centre, and the subprocessor list is available under NDA for vendor reviews.
FAQ
IT and cybersecurity background check questions
01Fraud and identity
How do I know a remote candidate is who they say they are?
Verify their government ID against a live selfie before any other check runs. Credibled's identity verification checks the document for tampering, matches the face, confirms liveness and detects video injected through a virtual camera or emulator. Then confirm their education and work history directly with the school and past employers.
Can identity verification catch a deepfake?
It's designed to. Passive liveness confirms a real person is on camera rather than a photo, screen replay, mask or generated image, and injected media detection looks for synthetic video fed through a virtual camera or emulator. Sessions the automation can't resolve go to human review.
What did Canada's advisory on North Korean IT workers recommend?
The July 2025 advisory from the RCMP, Public Safety Canada, Global Affairs Canada, FINTRAC and the Canadian Centre for Cyber Security recommends checking identity documents for forgery, holding video interviews, running background and reference checks, and verifying credentials directly with the schools a candidate lists.
Can you check a candidate who lives outside Canada?
Yes. Identity verification works with passports and national ID cards, international criminal record checks have published prices for 225 jurisdictions, and education and employment verification contact the school or employer wherever they are. International turnaround varies by country and is published per jurisdiction.
02Compliance
Does SOC 2 require background checks?
SOC 2 doesn't name background checks, but personnel screening is a common way to meet its criteria on hiring trustworthy, competent people, and auditors often sample new hires for screening records. ISO 27001:2022 is more explicit: control A.6.1 calls for background verification checks before people join.
What screening evidence do auditors usually ask for?
Typically a screening policy, the check record and completion date for sampled hires, candidate consent, and proof that screening was finished before system access was granted. Credibled keeps each check, its result, the consent and who ordered it, with timestamps.
Is a credit check allowed for IT roles?
Credit checks are usually reserved for roles with a clear reason, such as access to funds, payment systems or financial data, and they need the candidate's consent. Employment credit checks on Credibled are a soft inquiry, so the candidate's score isn't affected. Rules vary by province.
Can Credibled get my staff reliability status for a government contract?
No. Federal security clearances, including reliability status, are granted through the government's Contract Security Program. Credibled can run criminal record, identity and other checks on your staff, but it can't issue a clearance.
03Running checks
How long do IT background checks take?
Identity verification returns in seconds and most Canadian criminal record checks in about 15 minutes. Education, employment and reference checks depend on how quickly the school, employer or referee replies, and international checks have published turnaround per country.
Is there an API?
Yes. A REST API covers criminal record, identity, reference, employment and education checks, with webhooks on status changes and a sandbox included with sign-up. Recruiters can also order from Bullhorn, JobAdder or Vincere.
How much does it cost?
Pay per check, with no subscription, minimum or contract. Reference checks are $9 per candidate, however many referees. Other prices are shown during sign-up, and eligible Canadian startups get program pricing automatically.
Know who you're giving admin access to.
Create a free account and run your first check today. Pay per check, no subscription.