Netherlands | Right to Work & Pre-Employment Screening
Run statutory Verificatieplicht, Right to Work checks, and Pre-Employment Screening in a single journey. Tailored workflows trigger the exact checks needed for each role, client, or assignment, then push verified evidence directly to your compliance systems.
The catalogue
Set up your rules once per client or role. Every check delivers a clear status, detailed findings, and supporting evidence.
API
API. Direct integration with an official API.
Definitions we work to
Confirming before work starts that a candidate holds valid identity documents and has the legal right to work in the Netherlands, including matching the person to their document.
Completed once verification is passed and the candidate signs the required terms and tax statement (Loonbelastingverklaring), backed by a full audit log.
Reviewing a candidate's background against official sources such as diplomas, registers, and sanction lists to minimize role-specific risk.
Why Firstwork
Automatic workflows trigger the correct checks every time, eliminating manual routing and wrong checklists.
A unified candidate flow spanning application, Verificatieplicht, screening, document signing, and HR system updates.
Every document runs a scored, multi-point inspection with an explicit pass / fail / uncertain report.
ISO 27001 certified, EU (Germany) data hosting, full audit trail, and the right to be forgotten end to end.
Verification duty
EU, EEA, and Swiss nationals provide a passport or ID card. Non-EEA nationals supply residence and work permits (TWV) alongside sponsor details. The system routes each applicant automatically.
For placed vendor talent, the platform verifies documents but stores only the document number and expiry date. Full file retention applies solely to non-EEA candidates as required by law.
Previously screened talent is recognized: valid data reused, expired items trigger a limited re-check. Perpetual compliance without repeating the whole flow.
Expired document mid-process or a blurry upload? The Recollection Agent requests exactly the missing item by email and SMS, and the flow resumes where it stopped.
Document integrity
MRZ checksum, chip, document type and layout, expiry and font consistency.
Passport
MRZ, chip, expiry
+
Liveness
Face match to ID
+
20-point inspection
Scored, explainable
=
Verified identity
Bound to signing
Document type and layout, expiry and font consistency, category and issuing authority.
Driving licence
Type, expiry, category
+
Liveness
Face match to ID
+
20-point inspection
Scored, explainable
=
Verified identity
Bound to signing
Document ID •••• 4821 · inspected 2 Aug 2026, 14:07
17
of 20 checks passed · 2 uncertain · 1 failed
MRZ checksum (post-2000)
Passed
Document type & layout
Passed
Expiry & validity window
Passed
Font consistency
Uncertain
Portrait overlay / manipulation
Review
Illustrative, sample output
RTW · Dutch citizen
Passed
VOG · via Dienst Justis
In progress
BIG-register · healthcare
Passed
Document inspection
Finding, review
Diploma · DUO
Awaiting talent
Illustrative — status & findings, consultant decides
Passed. Check cleared.
Uncertain. Needs a closer look.
Review. Flagged for a decision.
Human in the loop. Any uncertain or flagged result goes to a consultant, who reviews the finding and makes the decision. The system never passes or rejects on its own.
Consultant control
Configure the platform so it never independently communicates a rejection to a talent. Negative RTW or PES results go to your consultants with the specific finding, and the consultant decides.
Live status of every request, open, completed, never completed, with lead times per check. Deviations trigger active notifications before they become problems.
On every completed check: approval or rejection, with the specific finding it's based on. No black boxes.
Statuses, signed documents, extracted values and correlation IDs returned over documented REST APIs (OpenAPI, Swagger, JWT/API keys, mutual TLS, SAML/OpenID/OAuth2 SSO). Your compliance framework makes the final judgment.
Security · Audit · Privacy
ISO 27001 certified. SOC 2 Type 2 certified. GDPR compliant. Aligned with the EU AI Act. Security scans and reports are shared with clients proactively.
All candidate data is hosted and processed in Germany. Information stays encrypted in transit and at rest. Custom retention policies ensure complete compliance with data deletion requests.
Digital signing is bound to the ID check, so the person signing is verified as the talent. eIDAS-compliant signing available via certified partner.
Every transaction records when an inquiry was sent and received, and by which user. Every message, action and status change is timestamped for compliance audits.
Every sub-processor involved in verification is disclosed in full in our Data Processing Agreement, with purpose and data residency documented for each.
SAML, OpenID and OAuth2 for IAM and SSO. JWT and API keys for REST services, with mutual TLS supported on every connection.
Questions procurement teams ask us
How does the platform support profile-driven workflows that automatically activate the correct set of checks?
Workflows are configured per client, assignment or job profile. When a talent enters a flow, the profile determines which RTW and PES checks run, nationality-dependent verification included, with no manual routing by consultants.
Can completed statuses or documents be forwarded automatically to specific client systems?
Yes. Completed statuses and documents, a validated VOG, for example, are forwarded to designated client systems per client profile, alongside the evidence returned to your own environment.
How does the platform detect fraudulent or tampered documents?
Every document runs through a 20-point, scored inspection: MRZ checksum validation across document eras, photo and font consistency, crop, overlay and manipulation signals. The result is an explicit report of checks passed, failed and uncertain, and suspicious documents are flagged for human review rather than silently passed.
How is digital signing verified as being performed by the correct talent?
Signing is bound to the ID check: the liveness-matched identity established during verification is the identity attached to the signature. eIDAS-compliant signing is available via certified partner.
Can the platform be configured so it never independently communicates a rejection to the talent?
Yes, a supported configuration, not a workaround. Negative RTW or PES results are delivered to your consultants with the specific finding; rejecting a talent for an assignment remains a human task.
How are previously screened talents handled when data must be reused or has expired?
The platform recognizes previously screened talent, reuses data that is still valid, and triggers a limited re-check only for items that expired during the term, supporting perpetual compliance without full re-screening.
Where is data stored, and how are retention and the right to be forgotten guaranteed?
Talent data is hosted and processed in the EU (Germany), encrypted in transit and at rest. Retention and deletion policies are configurable per client, deletion is automated on schedule, and right-to-be-forgotten requests are honored end to end with a full audit trail.
Which sub-processors are used for verification?
Every third party involved in performing any part of the verification is disclosed in full in our Data Processing Agreement, with purpose and data residency documented per sub-processor.
Does licensing limit API calls or user sessions?
No. Licences never physically limit API calls or user sessions, and the commercial model is pay-as-you-go with fixed unit pricing, you pay for checks actually performed, not for seats.
Commercial model
You pay for checks actually performed. No unused licences, no seat counts, no shelfware.
Unit prices fixed for the term of the agreement. Implementation and support costs specified up front.
Licences never throttle API calls or active user sessions. All core features are included in your agreement without surprise charges down the line.
