Security, sovereignty and compliance

Your data stays in your country.

Hiring data is personal data. Onyx stores it in the client's own country, keeps every client isolated, and never uses it to train models. You are the data controller; Onyx is the processor.

Sovereignty and residency

Your data is yours, and you know where it lives.

Data residency

CVs, recordings and transcripts are stored in the client's own country.

Sovereignty

Your data belongs to you. Every client runs in a strictly isolated environment. Data is never shared, sold or pooled.

Control

You decide how long recordings and transcripts are kept. Your data is never used to train the models.

Security by architecture

Protected at every layer.

Scroll to see how each layer wraps around your data.

  1. Your data stays yours

    Your CVs, interviews and hiring data belong to you. Every client runs in a strictly isolated environment. Data is never shared, sold or pooled.

  2. Application and data layer

    Encrypted in transit and at rest on SOC 2 Type II certified infrastructure, with role based access controls.

  3. Voice and interview layer

    Calls run on SOC 2 Type II certified voice infrastructure, encrypted, with retention of recordings and transcripts you control.

  4. AI layer

    Independently audited, SOC 2 Type II certified AI infrastructure. Your data is never used to train the models.

  5. Integration layer

    ATS connections are encrypted and credential scoped. Onyx only sees what your team authorises.

Compliance

Meets the rules where you hire.

EU GDPR

European data protection

UK GDPR

United Kingdom data protection

EU AI Act

Built and governed for high risk AI in hiring

Saudi PDPL

Saudi Personal Data Protection Law

The EU AI Act classifies AI hiring tools as high risk. Onyx is built and governed to meet that bar everywhere it operates.

AI disclosure

Candidates always know.

Every interview opens by telling the candidate they are speaking with AI and that the call is recorded, before a single question is asked.

  • Consent checks before automated outreach where the law requires them
  • Rejections either sent automatically with reasons, or held for human review. Your choice per account
  • Full transcript logging for audit
  • Security documentation and DPA available on request

Need the security pack?

We will send the security documentation and DPA with your demo.