Case study 02 — HR onboarding automation

Document AI

Onboarding paperwork arrives as scans: an ID, a tax record, three statutory forms, a contract. Someone reads all six, retypes about fifteen fields, and reconciles the values that appear on more than one document. We automated that, and the hard part was never the reading — it was deciding what to do when two documents disagree.

Vision model extraction
Serverless jobs
Per-page caching
Excel export

Document AI batch view showing per-candidate automation percentages

The problem

HR estimated fifteen to twenty minutes per candidate to read six scans, retype the fields and reconcile the ones that appear more than once. At the client's batch size of forty candidates that is roughly twelve hours of manual capture per intake. Onboarding is also bursty — a busy week, then quiet — so an always-on server spends most of the year billing for nothing.

What we built

Folders go in by the hundred and everything after that is automatic until a judgement call is needed. Pages are rendered and cached, each page is classified and read by a vision model, the same field from different documents is compared and format-validated, confident values are written and ambiguous ones are routed to a person with the evidence attached. The output is the client's own payroll template, filled.

How it works

Classified by content, not by filename
Six separate files, one combined PDF, or a phone photo of a single certificate all arrive at the same place. A badly named file changes nothing. Drag-and-drop is the only intake path, deliberately: a browser folder picker can return just one directory, so a Browse button would invite an attempt that cannot work.
Work is never repeated
Readings are cached per page, and every page read is a metered call. Adding one late document to a batch of forty re-reads one page, not four hundred. An interrupted run resumes rather than starting over.
Every value carries its receipts
Each field names the document and the page it was read from, and the page reference opens that rendered scan — so a value can be checked against the original in one click rather than by hunting through a folder.
Contradictions stop the line
Where enough independent documents agree and the value passes that field's format rule, it is written. A lone mismatch against a firm majority is overruled, but the disagreement is recorded on the field rather than discarded. Where there is no majority the pipeline refuses to choose: it shows its best guess and every reading behind it, and waits for a person.
A guess is marked as a guess
Some intakes name folders by payroll number rather than the expected employee code. Those folders used to vanish from the batch silently — indistinguishable from a failed upload. They are now accepted and kept exactly as written but flagged amber, because inventing a prefix would put a code nobody uses into the payroll column. The amber marking follows that value onto the batch list and the staging dialog, so it can never be mistaken for something read off a document.
Edge cases found by running it on real intake
Photographs are read like any scan, with camera rotation corrected and size capped, instead of the candidate appearing to be missing paperwork they supplied. A bare number needs five or more digits to be believed — four digits is a year far more often than an employee number, and without that floor a subfolder named 2024 quietly became a candidate of its own.
An audit trail that is not a second database
The log records that a named person confirmed a named field — never the value. An audit trail of ID numbers would be a liability, not a control. It is kept outside every workspace, so deleting an account cannot erase it, and each team member's workspace is isolated in the storage layer rather than by endpoint checks.
Costs nothing while nobody is using it
No container runs between batches, so billing follows use rather than the calendar. Extraction runs as a job on a cheaper billing model than a web service, which also means a long batch cannot time out a request. Concurrency is capped at eight candidates at a time — fast on a big intake, without a runaway bill.

In the product

Six-step pipeline from folder intake to filled payroll sheet — Folders in, pages rendered and cached, each page read, cross-checked, routed, sheet out.

Batch view showing automation percentage and field confidence per candidate — Which people need a human, and which do not.

Cross-validation view showing agreeing and disagreeing document sources — Three documents agree and it is written; two against two and nothing is.

Edge case handling for assumed codes and photographed documents — An assumed value is marked amber everywhere it appears.

Filled payroll template and the confirmation audit log — The deliverable, and the record of who confirmed what.

Engineering and economics summary showing scale-to-zero architecture — Matched to bursty intake rather than to a server left running.

Outcome

A working system in production use: bulk intake, page-level document AI, cross-validation with human routing, per-member access, an audit trail, rotation and resume, and export into the existing payroll template — delivered and handed over with the failure modes written down. The infrastructure saving is measured from the platform's own usage logs and the provider's published rates; the larger staff-time figure rests on HR's own estimate, and is presented as an estimate.

Have a system like this in mind?

Tell us the workflow you are trying to fix and we will tell you what it would take to build.

Start a conversation

Document AI

Vision model extraction

Serverless jobs

Per-page caching

Excel export

The problem

What we built

How it works

Classified by content, not by filename

Six separate files, one combined PDF, or a phone photo of a single certificate all arrive at the same place. A badly named file changes nothing. Drag-and-drop is the only intake path, deliberately: a browser folder picker can return just one directory, so a Browse button would invite an attempt that cannot work.

Work is never repeated

Readings are cached per page, and every page read is a metered call. Adding one late document to a batch of forty re-reads one page, not four hundred. An interrupted run resumes rather than starting over.

Every value carries its receipts

Each field names the document and the page it was read from, and the page reference opens that rendered scan — so a value can be checked against the original in one click rather than by hunting through a folder.

Contradictions stop the line

Where enough independent documents agree and the value passes that field's format rule, it is written. A lone mismatch against a firm majority is overruled, but the disagreement is recorded on the field rather than discarded. Where there is no majority the pipeline refuses to choose: it shows its best guess and every reading behind it, and waits for a person.

A guess is marked as a guess

Some intakes name folders by payroll number rather than the expected employee code. Those folders used to vanish from the batch silently — indistinguishable from a failed upload. They are now accepted and kept exactly as written but flagged amber, because inventing a prefix would put a code nobody uses into the payroll column. The amber marking follows that value onto the batch list and the staging dialog, so it can never be mistaken for something read off a document.

Edge cases found by running it on real intake

Photographs are read like any scan, with camera rotation corrected and size capped, instead of the candidate appearing to be missing paperwork they supplied. A bare number needs five or more digits to be believed — four digits is a year far more often than an employee number, and without that floor a subfolder named 2024 quietly became a candidate of its own.

An audit trail that is not a second database

The log records that a named person confirmed a named field — never the value. An audit trail of ID numbers would be a liability, not a control. It is kept outside every workspace, so deleting an account cannot erase it, and each team member's workspace is isolated in the storage layer rather than by endpoint checks.

Costs nothing while nobody is using it

No container runs between batches, so billing follows use rather than the calendar. Extraction runs as a job on a cheaper billing model than a web service, which also means a long batch cannot time out a request. Concurrency is capped at eight candidates at a time — fast on a big intake, without a runaway bill.

In the product

Outcome