Data security

Verified, not just claimed

Pactos processes personnel data across clients, master vendors and sub vendors. That is the most sensitive part of your supply chain, and your IT department will examine it. Here is what we can show, and the Trust Center holds the evidence.

Open the Trust Center AI and your data
Evidence

Three frameworks we hold ourselves to

One of them is confirmed by an independent auditor. For the other two we say exactly what the statement rests on.

Seal: ISO/IEC 27001 certified, issued by Proks Certification

ISO/IEC 27001 certified

An independent auditor confirms that Pactos identifies, manages and reviews security risks systematically. The scope covers development, operation and support of the platform. Issued by Proks Certification.

View the certificate
Mark: EU General Data Protection Regulation

GDPR-compliant

Processing under the EU General Data Protection Regulation, with a data processing agreement, disclosed sub-processors and an external data protection officer.

Mark: EU AI Act compliant

EU AI Act obligations met

Every obligation that applies today is implemented: no prohibited practices under Article 5, AI disclosure under Article 50 in every production feature, AI literacy under Article 4 trained and documented.

There is no certification procedure for the EU AI Act. We therefore name the articles whose obligations apply. The full classification per AI feature is available on request.

Operation and access

Seven points your IT review will tick off

Hosting in the EU

Operated exclusively in EU data centers on Google Cloud Platform. AI processing stays in the EU as well.

Encrypted, in transit and at rest

Transport encryption and encrypted storage, plus monitoring, backups and regular security testing.

Roles per party

Fine-grained permissions for client, master vendor and sub vendor, plus single sign-on via SAML.

A complete audit trail

Every action is logged and traceable in an audit, every AI call with provider, model and timestamp.

No training on your data

Client and candidate data is not used to train or fine-tune AI models, not by us and not by the providers we use.

External data protection officer

The role sits outside the company, with Kertos GmbH. That separates responsibility from operation.

Data processing under contract

Data processing agreement on request, sub-processors disclosed, AI providers engaged under data processing agreements.

All evidence in one place

The Trust Center holds the certificate, the policies and the details your review needs. No request, no waiting.

Open the Trust Center
  • ISO 27001 certificate
  • Data processing agreement
  • Overview of sub-processors
  • Information security policies
  • Answers to common security questionnaires
Principles

Five rules that apply to every AI feature

People decide

No AI feature decides on its own about candidates, applications or staffing. AI provides suggestions and drafts; people make the decision.

Transparency

AI-generated content is recognizable as such, and users know when they are working with an AI feature.

Data minimization

Every feature receives only the data it needs. Specially protected characteristics are excluded from features close to assessment.

No model training

Your data does not leave the purpose you entered it for. It does not train a model.

Traceability

Every AI call is logged: provider, model, version, timestamp. Results stay auditable.

The full overview with classification and oversight per AI feature is available on request. Request the overview

FAQ

Frequently asked questions

What does the ISO 27001 certification mean? ISO/IEC 27001 is the leading international standard for information security management systems. An independent auditor — in our case Proks Cert GmbH — confirms that Pactos identifies, manages and reviews security risks systematically. The scope covers development, operation and support of the Pactos platform. The certificate is in the Trust Center.
Do I get a data processing agreement, the certificate and a completed security questionnaire? Yes, and you do not have to ask: the data processing agreement, the ISO certificate, the overview of sub-processors and answers to common security questionnaires are in the Trust Center. Anything missing there, you get through your contact.
Where is our data processed? Exclusively in EU data centers on Google Cloud Platform. AI processing also takes place within the EU. Physical security of the data centers rests with the operator and is therefore not part of our own certification scope — that evidence comes from Google.
Is our data used to train AI models? No. Client and candidate data is not used to train or fine-tune AI models, neither by us nor by the AI providers we use. Those are engaged under data processing agreements.
Is Pactos compliant with the EU AI Act? Yes. Every EU AI Act obligation that applies today is implemented at Pactos: the platform contains no prohibited practices under Article 5, the transparency obligations under Article 50 are met in every production AI feature, and our teams' AI literacy is trained and documented under Article 4. For high-risk systems under Annex III the obligations only take effect on 2 December 2027. The one feature that falls under them is already being built to those requirements, including an impact assessment and mandatory bias testing. That puts us ahead of what the regulation demands.
How do I reach the security team? Send security-related reports and questions to privacy@pactos.ai. An external data protection officer is appointed for data protection requests, reachable at the same address.
Contact

Straight to our data security team

The Trust Center holds the certificate, the data processing agreement, the sub-processors and the answers to common security questionnaires. This form is for what is not in there.

Report a vulnerability, make a data protection request or ask for a document you are missing. Your message goes to the team itself, not into a general inbox.

Or straight by email to privacy@pactos.ai