Data Handling & Defense-in-Depth Encryption
Human Resources data contains the most sensitive personal, financial, and organizational assets an enterprise holds. GattAI treats every individual data point as an asset to isolate within strict tenant boundaries, not a commodity to circulate across microservices.
- Field-Level Envelope Encryption
- High-risk personal fields—including national identification numbers, bank account IBANs, base compensation, bonus structures, and confidential health records—are encrypted individually at the application layer using AES-256-GCM envelope encryption. Storage-level access yields only ciphertext without the customer-isolated Data Encryption Key (DEK).
- Encryption in Transit & at Rest
- All network communication requires TLS 1.3 with HTTP Strict Transport Security (HSTS) and Perfect Forward Secrecy. Database volumes, read replicas, Redis caches, and document stores utilize full-disk AES-256 encryption managed via cloud Key Management Services (KMS).
- Isolated Document Storage
- Employee contracts, identification scans, and payslip PDFs are isolated in private object storage partitions with public access blocked at the bucket level. Access is granted exclusively through short-lived, cryptographically signed URLs (15-minute expiration) logged on every request.
Zero-Trust Access Control & 13-Role RBAC
Access is denied by default across every API endpoint and data tier. Permissions are granted explicitly per object and tenant, ensuring that organizational hierarchy strictly dictates visibility.
- 13 Defined Operational Roles
- Granular role-based access control (RBAC) spans thirteen discrete system personas: Super Admin, HR Director, HR Manager, HR Specialist, Recruiter, Payroll Specialist, Performance Manager, Department Head, Direct Manager, Employee, External Auditor, Compliance Officer, and Candidate. There is no implicit privilege inheritance that silently broadens access.
- Row- & Object-Level Authorization
- Authorization evaluates dynamically on every database query. Being assigned a role that oversees certain requisitions or department reviews does not provide traversal access to unassigned records or executive salary bands.
- Strict Employee Self-Service Scope
- Employees can view only their personal profile, assigned objectives, submitted leave requests, and issued payslips. The employee role possesses zero query vectors to inspect peer files or organizational compensation tables.
- Enterprise IAM & Mandatory MFA
- Native integration with enterprise identity providers via SAML 2.0 and OIDC (Okta, Microsoft Entra ID, Google Workspace). Multi-Factor Authentication (MFA / TOTP) is enforced on all administrative, HR, and payroll roles.
The AI Data Pipeline & Cryptographic Isolation
External Large Language Models never encounter real employee or candidate identities. Before any inference request leaves the platform boundary, our deterministic pseudonymization engine sanitizes all direct and quasi-identifiers.
- Deterministic Pseudonymization
- Before an external API call is dispatched, names, emails, phone numbers, employee IDs, and national identifiers are replaced with ephemeral cryptographic tokens (e.g., [CANDIDATE_7A2F], [EMPLOYEE_9C04]).
- Encrypted Pseudonym Mapping
- The mapping table resolving tokens back to real human identities is encrypted with tenant-specific keys, confined inside the customer database partition, and never transmitted in prompt payloads.
- Stateless Text-In, Text-Out Execution
- Models operate in strict text-in, text-out isolation. Inference endpoints have no external network egress, no tool-calling access, and no connection to underlying relational databases.
- Prompt Injection Defense & Delimiter Sandboxing
- Untrusted input text—such as applicant resumes, uploaded case studies, and free-form review comments—is sandboxed within XML/Markdown boundary delimiters and parsed strictly as untrusted data, neutralizing prompt injection attacks.
- Zero Data Retention (ZDR)
- All enterprise model invocations operate under binding commercial Data Processing Agreements (DPAs) with zero data retention. Customer data is processed ephemerally in RAM and is contractually prohibited from being used to train or fine-tune public foundation models.
Tamper-Evident Hash-Chained Audit Trail
Every consequential event across the platform generates an immutable audit record. Audit logs are cryptographically hash-chained: each log entry embeds the SHA-256 hash of the preceding entry, meaning any retrospective deletion, reordering, or modification breaks the cryptographic chain and triggers an alert.
- Cryptographic Chain Verification
- An altered or deleted log entry immediately invalidates all subsequent block hashes. Compliance officers and independent auditors can run automated integrity checks to mathematically verify that the record has not been altered since generation.
- Exhaustive Event Coverage
- The audit log captures role and permission changes, compensation adjustments, document downloads, workflow approval actions, and full AI execution telemetry (prompt version, input snapshot, model ID, execution cost, and approver signature).
- SIEM & Log Forwarding
- Structured audit events can be streamed directly in standard JSON/Syslog formats to enterprise Security Information and Event Management (SIEM) systems such as Splunk, Datadog, or Microsoft Sentinel.
Cloud Infrastructure & Regional Resilience
GattAI is deployed on secure cloud infrastructure designed for maximum availability, strict network segregation, and regional data sovereignty.
- VPC Isolation & Network Security
- All database clusters, Redis queues, and Celery worker pools reside within private subnets with no public internet ingress. Ingress traffic routes through enterprise edge web application firewalls (WAF) with DDoS mitigation and rate limiting.
- Business Continuity & Disaster Recovery
- Automated daily encrypted database backups replicated across multiple availability zones. Recovery Point Objective (RPO) is under 1 hour; Recovery Time Objective (RTO) is under 4 hours.
- GCC Regional Data Sovereignty
- To comply with in-kingdom and regional data residency mandates, GattAI supports dedicated hosting tiers deployed in regional cloud zones across Saudi Arabia (KSA) and the United Arab Emirates (UAE).
Certifications & Vulnerability Management, Stated Honestly
We publish our precise operational posture openly. SOC 2 Type II and ISO/IEC 27001 certifications are actively scheduled on our pre-launch security roadmap; we state our controls factually today rather than make claims before formal attestations are issued.
- Automated Vulnerability Scanning
- Continuous Static Application Security Testing (SAST) and Software Composition Analysis (SCA) run across all code repositories on every pull request to identify vulnerable dependencies.
- Independent Penetration Testing
- Third-party security firms conduct annual grey-box and black-box penetration tests against our application endpoints, APIs, and cloud configurations prior to commercial GA.
When third-party audit reports are completed, attestations and SOC 2 Type II reports will be available for download under NDA directly within this Trust Center.