Security & compliance

Built for the rules on employment and AI

Employment decisions are high-risk by law. Orbio is designed for that from the first line of code: humans decide, agents inherit permissions, every action is logged, and the evidence your security and legal teams need is self-serve.

Open the Trust CenterTalk to security
01Certifications
SOC 2 Type IIIndependently audited controls, continuously monitored
ISO 27001Information security management
ISO 42001AI management system
GDPRDPIA and works-council documentation included
EU AI ActHigh-risk (Annex III) readiness for employment systems
Data residencyEU or US — your choice, per entity
02AI governance

Agents act. Your people decide.

A person makes every employment decision

Agents interview, summarise and recommend. Hiring, rejecting or ending a relationship is done by a named person, on the record. There are no automated rejections.

People know it’s an agent

Disclosed up front, in the candidate’s or employee’s language. A human is available on request at any point in the conversation.

Every recommendation shows its source

Each conclusion links to the conversation it came from. Your team can read the transcript before acting.

Independently audited for bias

Screening outcomes are monitored by group with adverse-impact analysis every quarter and an independent annual audit (NYC LL 144 compliant).

Your data never trains models

Customer data is used to run your deployment and nothing else. No cross-customer training, no vendor model training.

Human gates are configurable

Which actions need approval, by whom, at what threshold — set per entity, site and role.

03Security controls
AccessRole-based access per site, region and entity. Agents inherit the permissions of the person they work for. SSO / SAML, SCIM provisioning.
EncryptionTLS 1.2+ in transit, AES-256 at rest. Keys managed per region; customer-managed keys available on enterprise plans.
AuditImmutable log of every agent action with owner, source conversation and outcome. Exportable to your SIEM.
RetentionConfigurable per data category and jurisdiction. Deletion on request, with certificate.
Sub-processorsPublished list with region and purpose; change notifications 30 days in advance.
TestingAnnual third-party penetration test; continuous vulnerability scanning; responsible-disclosure programme.
AvailabilityMulti-region infrastructure, 99.9% uptime SLA on enterprise plans, status page.
04Regulatory coverage

Employment and AI rules, by jurisdiction. Tracked continuously; documentation available in the Trust Center.

RegionFrameworkStatus
EUEU AI Act — high-risk employment systems (Annex III)Ready
EUGDPR — DPIA, records of processing, works-council consultationDocumented
USEEOC — Title VII adverse impact (four-fifths rule), UGESPTested quarterly
USADA, FCRA, OFCCP record-keepingSupported
NYCLocal Law 144 — AEDT independent bias auditAudited annually
COColorado AI Act (SB 24-205)Ready
CACCPA / CPRA — automated decision-making regulationsReady
ILAI Video Interview Act; BIPACompliant
GlobalSOC 2 Type II · ISO 27001 · ISO 42001Certified

Your security review, answered before the first call.

Reports, policies, sub-processors, DPA and questionnaire responses — self-serve at trust.orbio.work.

Open the Trust Center