Paradox Olivia

Olivia is a text/chat-based AI assistant that handles the early, repetitive stages of hiring: answering candidate questions, screening against minimum qualifications, self-service interview scheduling, and onboarding paperwork, with a mobile-first design aimed at hourly and frontline workers rather than office knowledge workers. It integrates with existing ATS platforms (Workday, SAP SuccessFactors, Indeed among them) rather than replacing them. Paradox was founded in 2016 and has been selling this specific product for a decade, which puts it in a different category from a recent AI-wrapper startup — the conversational-hiring approach has been iterated on for years and is used by large employers in retail, restaurants, healthcare, logistics and hospitality for high-volume seasonal and location-based hiring.

Workday completed its acquisition of Paradox on October 1, 2025. Per Workday's Q3 FY2026 10-Q filed with the SEC, the total acquisition-date fair value of the deal was $1.1 billion — $1.0 billion in cash plus $20 million in fair value attributed to an equity stake Workday already held in Paradox before the full buyout. Workday's own announcement says the product is now sold as the "Workday Paradox Candidate Experience Agent," available for purchase through either Workday or Paradox, for both new and existing customers. The paradox.ai site, docs, and status page are all still live and separately branded, but for a buyer this means the roadmap, pricing and contracting now sit inside Workday's enterprise sales organization rather than an independent company — a materially different buying relationship than it was in 2024.

There is no pricing anywhere on paradox.ai — not on the homepage, not in the FAQ, and the /pricing path simply redirects back to the homepage. Every number in circulation (entry packages around $1,000+/month, mid-tier deployments in the $3,000-$8,000/month range, enterprise contracts reaching well into six figures a year) comes from third-party review and consulting blogs making estimates, not from Paradox or Workday, and should be treated as unverified guesses rather than facts. One independent GetApp reviewer specifically flagged cost as a concern, citing a roughly $1,000/month starting point, but that's a single review, not a rate card. Expect a multi-meeting sales and needs-assessment process before you see a number.

On June 30, 2025, security researchers Ian Carroll and Sam Curry reported that a McDonald's test account on Paradox's McHire platform was protected by the username/password "123456" and no multi-factor authentication, and that an insecure direct object reference (IDOR) in an internal API let anyone with McHire access page through sequential applicant IDs to read other candidates' chat histories with Olivia. Independent reporting (Wired, via Krebs on Security) is that this made roughly 64 million applicant records technically accessible. Paradox's own July 9, 2025 blog post gives a narrower account: it says the researchers actually viewed five candidates' records (names, emails, phone numbers, IP addresses), that no data was made public, that the test account had been dormant since 2019, and that it patched the API endpoint within hours of notification. Both of these are true simultaneously — a large population was exposed by the vulnerability, and a small number of records were confirmed accessed — and a buyer should read the difference, not just one side's headline number. Separately, Krebs reported a 2024 malware infection on a Vietnam-based Paradox developer's personal device leaked a reused seven-digit password giving access to Paradox accounts for several Fortune 500 clients including Aramark, Lockheed Martin, Lowe's and Pepsi, plus credentials to Paradox's Okta SSO and Atlassian systems. Paradox holds ISO 27001 and SOC 2 Type II certifications (in place since at least 2019, predating this incident) and launched a bug bounty program and a dedicated security contact ([email protected]) in response.

G2 shows Paradox at roughly 4.5-4.7 out of 5, though the exact review count differs depending on which G2 page you look at (39 reviews on the features page vs. 59 on the seller overview page), and G2's main reviews page blocks automated access, so treat the rating as directionally positive rather than precise. GetApp shows a lower and much smaller sample: 4.0 out of 5 from 8 verified reviews, with interview scheduling rated lowest (3.0/5) and cost flagged as a concern by at least one reviewer. Trustpilot has no accessible review page for paradox.ai. Separately, Wired's investigation into the security incident noted the researchers were originally drawn to McHire by Reddit complaints that Olivia was "spouting nonsense" and looping candidates — a candidate-side friction point independent of the vulnerability itself, worth noting since Olivia is candidate-facing by design.

Beyond the security page, Paradox maintains a real public status page (status.paradox.ai) with live incident history and uptime by component, and a genuine developer documentation site (readme.paradox.ai) covering authentication, candidates, interviews, and reporting endpoints with an OpenAPI reference — unusually transparent infrastructure for enterprise HR software, most of which doesn't publish either.