.png) When I published And Then The Dog Barked a month ago, I thought I had found the big reveal in this story. I had forced a trail via a GDPR Subject Access Request, found a forensic metadata anomaly suggesting a document had been retrospectively manufactured using Claude, and asked a multi-billion dollar corporation why a review dated April carried a June creation stamp. I believed I was entitled to see how that document had actually been produced, and that this was material that should have been in the first delivery of data. I was told this was a second request and that I would need to wait a further month for a response. I did immediately challenge this, but I was ignored.
I expected a curated, corporate defence. I did not expect the dog to bite its own tail.
A few of you asked, after the last piece, who this was actually about. I said I'd reveal it once I had a bit more information from them to go with it. I now have that.
This is ServiceNow.
A company whose entire commercial identity is built on selling other businesses seamless workflows, automated compliance, and trustworthy data handling. That's worth sitting with for a moment, because everything that follows happened at the hands of the compliance function of a company that sells compliance for a living.
There is a version of this story where a compliance team, faced with a difficult question, simply takes its time, gives a careful non-answer, and hopes the candidate moves on. That is not what happened here. What happened is more interesting, and considerably more revealing.
When I challenged their privacy team over the fact that my review appeared to have been generated using Claude, I said I was entitled to see the underlying material that had actually been fed into it. Their response, which arrived on the afternoon of the very last day of the GDPR request deadline, was a formal email intended to close the matter. To prove that the June document was a legitimate summary rather than a fabricated piece of retrospective fault-finding, they attached the raw internal chat from 15th and 16th April.
I want to sit on that timing for a moment, because I think it matters. I had challenged them on whether this was to be considered a second GDPR request. They ignored that challenge, insisted it was a secondary request, and took another 30 days. They used every hour of it. Whatever they eventually sent me clearly did not take a month, or even close to it, to locate and attach. It is hard to read that as anything other than a tactic. Make the person wait. Let urgency fade. Hope that by the time the answer arrives, the questions have lost some of their heat, or the person asking has simply moved on to the next thing in their life. Like the dog in this series of articles, I can be like a dog with a bone when I think something needs to be resolved properly. I hadn't moved on. I was willing, but not happy, to wait.
Now, with that single attachment, the dog bit its own tail. By producing that internal chat log in July, ServiceNow proved that their original June disclosure had been unlawfully incomplete. Those logs fell squarely within my original request from May for "internal communications... between recruiters and hiring managers." They had been withheld, sat on, and then, when they were needed to defend a different point entirely, produced without apparent recognition of what their release actually confirmed to me.
The same letter also relied explicitly on the contents of my CV to justify their account of what had been reviewed. Across two months and two deliveries of data, ServiceNow has never actually sent me that CV. I will be honest that I hadn't clocked this myself until I saw them refer to it. It was only when they used its contents to justify something that I thought, hang on, did they ever actually send me that? They had not. They are building a defence on a document they are simultaneously failing to disclose to the person it belongs to. After two months of asking, I still do not know whether I have all the data I am entitled to. I am no longer confident the CV is the only thing missing. In fact, given what I have seen, I would be tempted to put money on it.
Reading the chat itself was its own experience. I want to be careful here, because I cannot read minds and I am not going to claim certainty about intent. But the tone of what I read did not resemble a fair technical evaluation. It resembled someone looking for reasons to say no.
Before I go further, a brief word on how I know any of this. When ServiceNow first sent me the June document, they had not stripped the file's metadata. That metadata told me the document had been created using Claude, and told me who had been logged in when it was made. I will not name that person here, and I don't think it changes anything for the reader to know a name. I'll say only this. I have written before in this series about the suspicion that experience itself can become a liability in hiring, that a candidate with twenty years behind them can be read as a threat rather than an asset by someone earlier in their career. Nothing in what I read changed my mind about that.
What did that chat actually show? A hurried, surface level pass through my work, built on confirmation bias rather than curiosity.
The reviewer had been handed a list of everything I had shared, including a fully built local AI game called "The Hallucinated Truth," running LangChain against a local model. For a developer advocacy role focused on AI, you might expect that to be the first thing anyone would open. It can be spun up on a MacBook Pro M3 in about five minutes. It was never mentioned. You can see it in GitHub here:
https://github.com/rilhia/the-hallucinated-truth
Instead, the review started with EarthTunnelling.com, a proof of concept I had built that lets you point your phone in any direction, at any angle, and see exactly where that line would emerge on the other side of the earth, along with the distance travelled both through and around the planet. It is not an antipode calculator. Nothing else does this. The chat criticised the UI of a desktop screen essentially telling the user that it's a website built for smartphones. Granted, the UI isn't great at all. It is just a POC. What it does is what I put the effort in to. Did they mention the concept? No. They did not mention what the project actually does. Not once.
Then there was Omni-Endo-AI, a tool I built for people with type 1 diabetes to work with their own insulin pump and glucose data. The chat recorded this assessment of it:
"It's not really a tool embedded with AI... he instead has the app link out to ChatGPT or Gemini in a new window and then you copy a prompt... he didn't really think too hard on the user experience and that is a concern"
The project's own documentation explains that choice directly, that requiring often non-technical users to set up and pay for API keys was a blocker, and that an explained manual copy and paste step would let more people actually use it. It was a considered decision, made with the real user in mind. The reviewer criticised it as an oversight. The documentation explaining it was sitting right there. You can see the section here:
https://github.com/rilhia/omni-endo-ai#-the-no-api-philosophy-why-this-is-different
The same reviewer then took issue with a throwaway line I had written about sometimes tinkering with a new tool before reading its documentation properly. He didn't like this:
"For a dev rel this is not something you want to say"
He wrote that having, by his own clearly evident conduct, not read the documentation for a project sitting right in front of him.
Even a colleague in that same chat seemed to sense something was off. At one point they pushed back directly, asking whether skipping the docs was really such bad behaviour for a developer advocate. The reviewer's answer was that it was more about saying it than doing it. The colleague tried again, suggesting that jumping in and tinkering was arguably a form of authenticity developers respond to. The conversation moved on without resolving it.
I'd point out that this throwaway line about reading docs generated more back-and-forth in that chat than the technical substance of my portfolio. Take my Dataiku article, which explains how I built a system to map thirteen years of my entire life's location history from a massive, raw Google Takeout export. The actual point of the piece, the massive data integration and processing achievement, wasn't mentioned once. Instead, the reviewer logged this:
"It leaves me wondering what the fuck is Dataiko[sic]?"
That chat was then run through Claude, and what came out the other side was the clean, structured, entirely one-sided document I was originally sent as part of my Subject Access Request. Not this conversation. Its sanitised output. I still do not have the whole thing. The chat excerpt I was given clearly starts mid-conversation.
Something has happened since that review that I think is worth including here for context. It gives an interesting contrast. I was recently contacted by a company that works in the diabetes space about a project I built, closely connected to the Omni-Endo-AI piece. They looked at the concept, got in touch, and have engaged with it seriously. I had a meeting with them yesterday. A company that actually works in this field saw value in something a reviewer with no apparent background in it dismissed in a few lines, without reading the reasoning behind it.
I do not know for certain why my work was reviewed this way. I am not going to claim I can prove intent I cannot see. I raised the possibility directly with ServiceNow's leadership before writing this. I do not know the answer. I think it is a fair question to keep asking.
So, ServiceNow tell candidates their work lacks polish, while their own compliance team misses statutory deadlines, loses track of a candidate's CV, leaves employee names in file metadata, and waits until the final hour of a deadline to hand over the one document that undoes their own defence. The candidate whose work lacks polish spots these flaws, challenges them, watches them hoist themselves by their own petard, and writes about it.
I have not yet filed a complaint with the Information Commissioner's Office. I am giving ServiceNow the opportunity to respond fully first, so that whatever I ultimately submit reflects the complete picture rather than a partial one. But the file is being kept, in detail, and it is not going away.