An accredited body certified the information security management system, validating controls across people, process and technology.

Platform design, contracts and operational processes adhere to major privacy laws, giving customers a ready foundation for global compliance.

AI functions are classified and managed as high-risk employment systems, positioning customers for forthcoming regulatory duties.

The platform achieved a TISAX rating for information with very high protection needs, recognised by automotive industry partners.

Cobrainer fulfils provider obligations for high-risk employment AI systems, including transparency, risk management and human oversight measures.

AI features are designed as decision-support tools with human oversight to satisfy high-risk system obligations under the draft act.

Documented guidance and direct assistance help customers complete DPIAs and meet Article 28 obligations.

Legal and compliance teams track global HR-AI regulations and update controls as requirements evolve.

A clearly defined split between provider and customer duties clarifies who manages which controls, streamlining compliance assessments.

Management commits to delivering an externally audited SOC 2 type II report to customers for continuous assurance.

Comprehensive artefacts covering security, privacy and AI governance are maintained to support customer due diligence and regulatory audits.

An independent TÜV SÜD assessment reported zero exploitable vulnerabilities in the public APIs.

Documentation and access to assurance materials are provided to help customers complete their own audits and risk assessments.

Dedicated processes track legal developments and update controls so that the platform stays aligned with evolving standards and legislation.

Skills classification, content generation and other AI functions undergo testing before release and during updates.

A respected external security firm conducts annual penetration tests on the production environment, confirming there were no critical, high, medium or low findings in the latest assessment.

Functional, security and data handling tests are executed before each release and during updates to catch issues early.

Engineering teams run additional penetration tests during each development cycle to uncover issues earlier and reinforce secure coding standards.

Dedicated reviews evaluate model behaviour, edge cases and potential HR risks, ensuring outputs remain suitable for employment contexts.

Testing and risk assessments are treated as ongoing tasks, keeping controls effective as the product evolves.

Cobrainer considers assurance reports from infrastructure and service partners to verify that upstream controls meet required standards.

A qualified vendor performs semi-annual vulnerability scans across infrastructure and applications, generating risk-ranked reports and remediation guidance.

Testing and assurance are treated as ongoing disciplines rather than one-time events, providing sustained confidence over the product’s life.

Automated SAST tools are integrated into the CI pipeline to identify insecure code patterns before changes are merged.

Results from third-party audits and certifications are factored into the platform’s overall assurance posture.

New model versions are introduced only after they meet defined quality expectations and stability checks.

Every build automatically scans open-source libraries, container images and infrastructure code for known CVEs and configuration weaknesses.

Up-to-date evidence packs help customers satisfy their own auditors without extensive additional work.

Customer data is logically separated so that job structures, skill extensions and configurations are never shared across tenants, eliminating cross-customer data leakage.

Processing is restricted to data strictly necessary for HR use cases, lowering the attack surface and compliance burden.

All stored customer data is protected with AES-256 encryption managed by AWS Key Management Service.

Cobrainer processes personal data solely on documented customer instructions, maintaining the customer’s status as data controller.

Organizations set retention schedules while the platform enforces them, aligning storage with legal requirements.

Privacy principles such as purpose limitation, data minimisation and access control are embedded into product architecture from the outset, ensuring lawful processing without retrofitting.

TLS 1.2 or higher secures every connection between the platform, integrations and end-user browsers.

Processing is limited to the information strictly required for configured HR use cases, reducing exposure of unnecessary personal data.

Platform operations and terms are structured to support compliance with European and Californian privacy regulations.

Production workloads and backups remain solely in the AWS Frankfurt region, keeping data inside the European Union.

Only non-identifiable data is used to enhance platform capabilities, avoiding exposure of customer-specific information.

Customer job structures and skill extensions remain isolated and are not shared with other tenants.

The platform provides mechanisms to delete or anonymise data on customer instruction and never stores personal information longer than contractually agreed.

Application credentials are stored in AWS Secrets Manager, accessed through role-based policies and rotated on a scheduled or on-demand basis.

Personal data is kept only as long as required for agreed services and legal obligations, after which it can be deleted or anonymised.

Data subjects and client administrators can trigger irreversible deletion of personal data, with actions logged and reported back to the controller.

When transfers outside the EU/EEA are necessary, recognised legal mechanisms and contractual protections are applied to maintain compliance with data protection laws.

Security is integrated across the system design to protect against unauthorized access, data loss and misuse.

End-to-end security controls are embedded across the system architecture to guard against unauthorised access, data loss and misuse.

The service is engineered with layered controls to protect confidentiality, integrity and availability of HR data.

All production services run in the AWS eu-central-1 region, leveraging three availability zones for resilience.

Logical separation prevents one customer’s data from being accessed by another, preserving confidentiality.

Separate public, private and database subnets confine traffic flows and minimise exposure surfaces.

Connections to external HR systems use restricted channels and scoped data exchange, limiting exposure to third-party risks.

Connections to external HR systems use controlled interfaces and limited data scopes, reducing integration attack surfaces.

Databases reside in non-routable subnets, accepting connections only from approved application services.

Internal role separation and access restrictions safeguard operational environments and reinforce accountability.

Data exchanged with external systems such as SAP SuccessFactors and Workday flows through controlled, security-checked interfaces.

Workloads are deployed across multiple AZs to survive data-centre failures without customer impact.

Continuous observation of infrastructure detects anomalies early, helping avert service disruptions and security breaches.

Security groups default to deny-all and explicitly allow only required ports between tiers and to the internet.

Security requirements and threat modelling are embedded in agile sprints from design through deployment.

Engineering teams embed security considerations throughout product development, lowering inherent risk.

AI tasks run only when triggered by a clear UI action, eliminating hidden processing.

Generated classifications and content undergo validation to confirm accuracy and suitability for HR use cases.

Suggested job structures, skills or content can be accepted, modified or rejected before they affect organisational data.

Build pipelines block releases that fail security scans, ensuring only compliant code reaches production.

Contextual information is provided to help users understand AI suggestions, fostering trust and accountability.

Design emphasises reviewability and user control to avoid over-reliance on algorithmic recommendations.

Every change is reviewed and approved by qualified engineers, adding human oversight to automated checks.

Customers can edit or reject AI-generated results before adoption, preventing unintended impacts.

Dedicated development, staging and production accounts prevent cross-environment impact and enable safer testing.

Organisations decide which AI features to enable and how outputs are adopted, aligning use with internal policies.

The application enforces modern cookie settings and session controls to mitigate hijacking risks.

The platform supports SAML, OAuth and OpenID Connect so customers can enforce their own identity provider policies.

Permissions are assigned to roles so that each user only sees and performs actions that fit their responsibilities, reducing the likelihood of unauthorized data exposure or configuration changes.

Platform permissions are assigned to roles so that users only see data and functions aligned with their responsibilities.

Customers can create and manage their own roles and permission sets, allowing them to align platform access with internal governance and segregation-of-duties requirements.

Administrators can configure and tailor access rights to match internal governance requirements, ensuring the platform aligns with segregation-of-duties policies.

Administrators can tailor roles and entitlements to match internal governance and segregation-of-duties requirements.

High-impact tasks such as configuration changes and AI feature management are limited to designated administrative roles, preventing accidental or malicious alterations.

All internal services and tools require MFA, adding a second verification step beyond passwords.

Organisations may enable or disable specific AI capabilities per role, ensuring that only authorised users can invoke automated assistance.

High-impact configuration changes and AI feature management are limited to designated roles, preventing accidental or malicious alterations.

AI features operate only when a user deliberately triggers them in the interface, keeping automated processing under continuous human oversight.

Employees who connect remotely must authenticate with hardware or software tokens in addition to credentials.

AI functions activate only after an explicit user action in the interface, guaranteeing human oversight for every AI-supported task.

User accounts are created, reviewed and removed via an HR-linked process that includes quarterly manager attestations.

Cobrainer employees follow strict internal access limitations and role separation when developing and operating the platform, safeguarding customer environments from insider risk.

Product, engineering, security and legal teams jointly oversee AI features, embedding accountability into every lifecycle stage.

Product, engineering, security and legal stakeholders jointly review and approve AI system changes for risk and compliance impact.

Cross-functional committees oversee AI design, deployment and retirement, embedding accountability across the organisation.

Decisions on model updates and safeguards undergo documented review to assess legal, ethical and operational impacts.

Clear owners are assigned for every AI change, covering technical performance, legal compliance and user impact.

Staff involved in AI receive role-specific guidance on legal obligations and platform limitations, reducing the risk of misguided development.

Skills-based representations and human review are used to reduce reliance on biased proxies and support equitable outcomes.

Structured pathways allow emerging AI risks to be raised and resolved before they affect customers.

Models are versioned, monitored and updated using curated datasets, keeping outputs accurate as skill landscapes evolve.

The platform deliberately prevents fully autonomous employment decisions, requiring humans to review and approve AI suggestions.

Regular reassessments verify that controls stay effective as technology, regulation and customer use cases evolve.

Suitability and risk profiles of external language models are reassessed to maintain security and compliance alignment.

Contractual DPAs with AWS and Mixpanel impose GDPR-aligned security, privacy and audit obligations.

Large language model providers are selected against criteria for quality, latency and regional deployment, ensuring safe content generation.

Third-party large language models undergo suitability assessments to confirm ongoing legal and security compliance.

Cloud infrastructure is provisioned in Frankfurt, ensuring subcontractor storage stays within the EU.

Only information required for a requested task is transmitted, limiting exposure when leveraging external AI services.

The risk profile of external models is re-evaluated over time to maintain alignment with legal, security and performance expectations.

Telemetry is processed only in the Netherlands data centre under an agreed GDPR DPA.

A current list of external models and service providers is available to customers via the security contact.

Assurance reports from infrastructure and service partners are incorporated into overall risk management to validate upstream controls.

Data shared with platforms like SAP or Workday is limited to necessary fields and transmitted through protected interfaces, minimising exposure.

Cobrainer evaluates and documents the security posture of each subprocessor as part of onboarding and renewal.

Third-party audit reports and certifications are factored into overall platform risk management.

Organizations decide which HR systems to connect and what data flows, retaining authority over third-party integrations.

Every API call is evaluated against the caller’s role before execution, blocking unauthorised actions.

Configured thresholds throttle excessive requests, reducing the impact of brute-force or model-stealing attempts.

Integrations authenticate with unique client IDs and certificates stored securely in Secrets Manager.

Server-side routines cleanse and validate all incoming data to prevent injection and deserialization attacks.

Datadog and AWS CloudWatch track performance, errors and capacity to spot anomalies quickly.

The platform is continuously observed for events that could indicate compromise or misuse, enabling swift intervention.

Telemetry is analysed to spot security-relevant events and abnormal behaviour across the service.

The platform observes operational metrics and logs to spot suspicious activity that could indicate compromise.

Detective controls flag unusual behaviour patterns that may signal threats before they escalate.

Automated safeguards help stop unauthorised access while alerting teams to potential threats.

Automated checks identify unusual behavior patterns, enabling rapid investigation and response.

GuardDuty, CloudTrail and third-party SIEM tools correlate logs for threat detection across the stack.

Administrative actions and API calls are immutably recorded for forensic and compliance purposes.

Monitoring data feeds into preventive measures that block unauthorized actions before they escalate.

Monitoring extends to AI outputs so unexpected results can be flagged for investigation.

Combined monitoring and prevention measures reduce the likelihood of unauthorised access and improve response accuracy.

Deviation thresholds trigger instant notifications to on-call engineers and security staff.

Alerts route through defined channels to ensure timely investigation by responsible personnel.

Security event and access logs are stored for at least one year, supporting investigations and audits.

Team members receive guidance on secure development and data handling practices, reducing human-related risks.

Employees involved in platform development and operations receive training to recognise and mitigate threats.

Access to production systems is limited and segregated, preventing concentration of sensitive privileges.

Employees must reaffirm understanding of security and ethics policies every year.

HR verifies candidate backgrounds and references before granting access to sensitive systems.

Clearly defined ownership enables swift escalation and accountability for security matters.

Random inspections enforce the removal of sensitive materials from workspaces after hours.

Managers validate that permissions for their team members remain appropriate for current duties.

Functions allow access, rectification, deletion and portability requests to be fulfilled within legal timeframes.

New users must actively accept a client-controlled consent statement before accessing the service.

Built-in functions support access, rectification, deletion and portability requests, helping customers comply with privacy laws.

Platform features incorporate purpose limitation and data minimization principles from the outset, lowering exposure of personal data.

Individuals can disable employee-facing features when allowed by company policy, supporting transparency and voluntary participation.

The latest privacy policy is always reachable from onboarding screens and account settings.

Where enabled, individuals can view their data and opt out of specific features, fostering trust and legal compliance.

Individuals can download a comprehensive PDF report of their stored personal data at any time.

Customers can access, export, rectify or delete personal data through native tooling, streamlining compliance with legal requests.

Contractual and technical measures ensure customers remain data controllers while Cobrainer processes data strictly under instruction.

The platform helps customers inform employees about AI usage and the role of human decision-makers.

Recognised mechanisms and contractual protections secure any personal data moved outside the EEA.

Configuration options let organisations tailor transparency notices and approval flows to match internal policies and works-council agreements.

Personal data is stored only as long as required for contracted services, with tools that permit scheduled or on-demand deletion.

Users decide whether their information is seen by all employees, recruiters, managers or talent developers.

Cross-border data flows rely on recognized legal mechanisms and contractual protections, maintaining privacy compliance worldwide.

Users can permanently delete their account and associated data without contacting support.

Clear procedures define roles and steps for identify, contain, eradicate, recover and review phases.

Dedicated mechanisms allow customers to report suspected security or AI issues directly to the response team.

Customers can promptly report suspected incidents through defined contact points, accelerating triage and containment.

Customers can report suspected incidents through defined contact paths, ensuring rapid engagement with the response team.

All reported events are triaged to determine scope, impact and required containment actions.

Every report is triaged to determine severity and scope, with containment and remediation steps executed according to predefined playbooks.

Monitoring tools instantly notify the security team of anomalies in metrics, logs or threat feeds.

Affected organizations receive incident updates in compliance with contractual and legal requirements, aiding coordinated response.

Customers, regulators and law enforcement are informed promptly and transparently when applicable.

Affected customers receive prompt notifications and status updates in line with contractual and legal obligations, enabling them to meet their own disclosure duties.

Lessons learned feed back into technical safeguards and processes to reduce likelihood of recurrence.

Each incident triggers a lessons-learned session to refine controls and prevent recurrence.

Root-cause analysis drives corrective actions and process improvements, strengthening defences against future events.

Root causes are analyzed and corrective measures implemented to prevent recurrence and strengthen the control environment.

AI-specific anomalies follow the same rigorous process, ensuring consistent governance regardless of incident source.

The same framework addresses unexpected AI outputs or limitations, allowing model adjustments or configuration changes when needed.

Findings feed back into risk management, updating policies, playbooks and training.

Critical data stores are backed up on a scheduled basis with validated restoration procedures.

Model and software updates are rolled out in a managed manner to maintain platform stability for customers.

Ongoing monitoring and adjustment of models ensure reliable functionality as organizational contexts change.

Documented RTO/RPO targets and recovery steps guide teams during major service interruptions.

Infrastructure health checks detect issues early, supporting rapid remediation and minimizing downtime.

Configurations, code and infrastructure states are regularly saved to isolated storage for rapid rebuilds.

Services are distributed across multiple zones so that single-site failures do not disrupt customers.