.png&w=384&q=75&dpl=dpl_3siZ5RR8vCRtPVQXAJwpgECBsn2R){kind=small}
Security and AI governance
Agents work by the rules your team sets
How we protect your candidates' data, what Selenios agents can do, and where each certification stands.
01
Certifications and frameworks
The actual status of each one.
SOC 2 Type II
Audited · Sept 2026Report issued in late September 2026 by an independent auditor. Controls are continuously monitored in Vanta.
GDPR
CompliantRight to be forgotten and data portability, with verifiable deletion.
Penetration testing
March 2026The platform's most recent penetration test was in March 2026.
Agentic Trust Controls
In progressVanta's framework for AI agents: identity, permissions, human oversight, action logging and adversarial testing.
ISO/IEC 42001
In progressAI management system. It is the next step after Agentic Trust Controls.
EU AI Act
PreparingAI used in employment is high-risk (Annex III). We already tell candidates they are talking to an AI, keep human oversight in place and log agent actions.
02
AI governance
What agents do, what they cannot do, and how candidates find out.
Your team decides what gets automated
Seleni proposes each change and asks for confirmation, one at a time and showing the exact change. Stage agents act only under the rules your team turns on, with the rejection reasons and templates you define.
Critical actions stay with people
No agent can delete data or manage users, roles, SSO, 2FA or billing.
Candidates know they are talking to an AI
The voice interview page says so before it starts, and so does the first WhatsApp message. On WhatsApp, that notice cannot be removed.
AI output is labelled
Suggestions carry a "Suggested by AI" label, and your team can read the transcript of every interview before deciding.
Your data does not train models
The platform's language models and embeddings run on Amazon Bedrock, inside Selenios' AWS account. Voice interviews run on ElevenLabs. Neither Bedrock nor ElevenLabs trains on your data.
We test the AI against attacks
Prompt injection and jailbreak testing, personal data detection and a log of every agent action.
03
Security controls
Enterprise-ready infrastructure, from day one.
Enterprise SSO
SAML 2.0 and OIDC with your identity provider: Okta, Azure AD, Google Workspace.
Granular roles & permissions
Role-based access control with fine-grained permissions and position-restricted roles.
Complete audit logs
Every action recorded: access, configuration changes and hiring decisions.
AES-256 encryption
Data encrypted in transit and at rest. AI models are never trained on your data.
GDPR by design
Right to erasure and data portability, with verifiable deletion.
Clear data retention
Permanent data deletion 90 days after the contract ends.
Does your security team need more detail?
Request the SOC 2 Type II report and our policies in the Trust Center.