How This Briefing Works
This dossier opens with key findings, then maps the gap between what Finch discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 1 sites
vendor fires before consent
Briefing
Finch operates as an employment data platform providing unified API access to payroll, HRIS, and benefits systems. The platform processes sensitive employment data including compensation, benefits enrollment, and worker classification. Core threat lies in the aggregation of employment records across multiple employers and the consent bypass mechanisms that enable data collection without explicit worker notification.
What This Means For You
HR and finance teams using Finch gain unified access to employment data but inherit three critical liabilities: (1) Worker privacy violations as consent bypass enables data collection without explicit notification, (2) Competitive intelligence leakage as compensation and headcount data feeds platform analytics shared across customers, (3) Special category data exposure from benefits and health information creating GDPR Article 9 liability. The platform's aggregation model makes it impossible to audit which external parties access your employment records.
Risk Channel Breakdown
Finch introduces measurement distortion in workforce analytics by normalizing data across incompatible HRIS schemas, creating false precision in headcount and compensation reporting.
Employment data aggregated by Finch feeds competitive intelligence systems, revealing compensation benchmarks, benefits structures, and hiring velocity to platform customers in competitive industries.
Expands attack surface
Session recording of HRIS interactions combined with consent bypass creates GDPR Article 9 special category data exposure (health data from benefits, union membership, etc.). Fingerprinting enables cross-employer tracking of individual workers without explicit consent.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Full session replay
Ignoring CMP signals
Device identification
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Finch's public claims against observed runtime behavior and identified 1 contradiction.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
4 for current users · 4 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →