Skip to content

Security

Salaries, contracts, personal IDs: secured by default

As an employer you hold the most sensitive information about your team. Taito.ai is ISO 27001 certified and GDPR compliant, with encryption in transit and at rest and granular field-level permissions. Nothing changes in an employee profile without a log entry. The trust center publishes the certificates and the current state of every control.

Explore trust center

Audited security

Security is fundamental to how we work

Security is not a feature we added. It's the foundation for how we work and build our product. One product tier ensures everyone gets the same level of confidence when handling employee data. An external body audits us against ISO 27001 regularly, so we continue to meet the standards as security risks change.

ISO 27001 certified

DetailsISO 27001 certified

GDPR compliant

DetailsGDPR compliant

EU data residency

DetailsEU data residency

Field-level permissions

DetailsField-level permissions

Security controls

Secure defaults,
for every account

Enterprise-level security built-in for everyone, not as a paid add-on.

  • Encryption in transit and at rest

    TLS encrypts every request, and we encrypt everything we store at rest. There's no cheaper tier where that changes.

  • Granular field-level permissions

    Salary, personal identifiers and other sensitive fields are visible only to the roles you grant, and fields you mark Restricted or Secret are withheld from the AI. The same rules apply in the web app, in the Slack agent, and over MCP.

  • An activity log for every change

    Taito.ai logs every change to an employee profile: who changed it, what changed, and when. That includes the changes agents make. You can export the log when an auditor asks.

  • No model training on your data

    We don't train AI models on customer data, and our AI providers may not either. It's used only to provide the service to you. The trust center lists which sub-processors handle it, and under what terms.

  • Deletion we commit to

    On termination your data stays available for export for 30 days and is then deleted under the DPA. You can export in full at any point, including when you leave.

  • Independently tested

    Our controls are audited against ISO 27001 by an external body, and the platform is penetration tested periodically by an outside party. Reports and current certificates are in the trust center.

Agent security

Safe and secure AI,
with human review

Agents run workflows end-to-end. They also stop whenever human confirmation is needed.

Runs automatically

Reminders and follow-ups, data cleanup and profile updates, scheduling, reports and drafts, and review-cycle orchestration.

People make the decisions

Agents do the work your team asks for. Decisions about people always stay with a person.

Mistakes are visible and reversible

Full activity history and decision reasoning, always visible. You decide on every change, and the history shows exactly what happened.

Two activity cards: a routine reminder the agent sent on its own and logged, and a salary change it stopped before syncing to payroll, routed to a person to approve.

Documentation

The paperwork your legal team will ask for

Transparent and up-to-date security documentation available for you and other stakeholders.

  • Trust center

    Trust center

    Certificates, current controls and audit reports, kept up to date.

  • Data processing agreement

    Data processing agreement

    Our obligations as processor, and the terms our sub-processors must follow.

  • Privacy notice

    Privacy notice

    What we collect as a controller, and on what legal basis.

  • Sub-processor list

    Sub-processor list

    Who processes customer data on our behalf, and where.

  • Terms of service

    Terms of service

    The contract that governs everything else on this page.

  • Document archive

    Document archive

    Earlier versions of the terms, privacy notice and DPA, kept for reference.

Frequently asked questions

Where is our data hosted?
Our main database runs in the EU. The AI providers behind the assistant are the exception, see "Is data sent outside the EU for AI?" below. The trust center documents the specifics: regions, where each sub-processor is located, and what residency commitments are available. That's the version that stays up to date.
Do you train AI models on our data?
No. Customer data is used to provide the service to you, including the assistant's conversation history and saved memories. It is never used to train our models or a vendor's.
Which AI providers process our data?
The assistant runs on Anthropic or OpenAI. Your admin chooses which one in the AI agent settings, and other AI providers on the list may support functions such as search. All of them are on the sub-processor list.
Is data sent outside the EU for AI?
It can, when someone uses the assistant or an agent. Anthropic and OpenAI may process requests outside the EU, including in the US, under an EU adequacy decision or the EU Standard Contractual Clauses. The DPA covers these transfers, and the sub-processor list names the location and mechanism for each provider.
Can the assistant read identity codes or health data?
Not from the fields you protect. Mark a custom field Restricted and the assistant can see the field is filled in but not what it says. Mark it Secret and the assistant can't see the field at all. Common identity code and bank account formats are also removed from chat messages on a best-effort basis, but it's still up to your team what they type. Everything else, including built-in fields such as date of birth, absence types and uploaded documents, stays readable to the assistant within the user's permissions.
Can Taito.ai staff see our data?
In the product, only when your admin grants support access. A grant is time-limited, up to 30 days, is either read-only or allows edits, and can be revoked at any time. Support sessions are logged and visible in your settings. Outside the product, a small number of engineers can reach production systems to keep the service running, under confidentiality and only when needed.
Who can see salary and personal identifiers?
Only the roles you grant. Field-level permissions apply in every tool that reads the data, including the Slack agent and MCP clients. Every change is logged, and so is every support session.
What happens if an agent gets something wrong?
It appears in the activity log, attributed to the agent. Anyone with permission to change that data can reverse it. Agents act on your team's instructions, and decisions about people always stay with a person.
Are you ISO 27001 certified?
Yes, and GDPR compliant. The base price includes both, not a higher tier. The current certificate and the controls behind it are in the trust center.
Can we see a penetration test report?
The platform is penetration tested periodically by an external party. Reports are available through the trust center.
Can we export or delete our data?
Full export at any time, including on cancellation. On termination your data stays available for export for 30 days, is then deleted from our active systems, and is removed from backups within 90 days, as set out in the DPA.