Get startedTrust & security
Built for companies that take security seriously, from the ground up, not patched together before an audit. Where a certification is still in progress, we say so.
01Five tests
Every part of Actaa passes the same five tests.
Nothing ships until it passes all five.
- 01
Private from the start
Every AI request runs inside our own cloud. Actaa runs no model training, and nothing is sent to a consumer AI service.
- 02
Kept apart by design
Each company’s data is separated below the application, not just hidden in the interface.
- 03
Checked against the rules
Every feature is checked against the rules that apply to it before it ships: GDPR, the SOC 2 controls and the laws on AI in hiring.
- 04
Secure from day one
Encrypted when stored and when moving, multi-factor sign-in, and an append-only audit record.
- 05
Priced to replace the stack
One bill, one security review and one login for the whole company.
02Your data
Take your data with you, or have it erased.
Export your profile, documents, file list, mailbox list and audit history as JSON, and your mail as a standard mbox archive.
- 01
Who can use it
Anyone with an Actaa Network profile can do it from their settings. Anyone else can ask their workspace admin.
- 02
Erasure is final
Erasure removes your identity from every workspace and cannot be undone.
- 03
Done, not promised
GDPR Article 17 (erasure) and Article 20 (portability) are implemented today.
03No scores
The hiring AI never judges a person.
It is not an automated hiring decision tool. It pulls out and summarises what a candidate wrote. It never scores, ranks, filters or recommends anyone.
- 01
Built with the law in mind
Designed with NYC Local Law 144, California FEHA, Illinois HB 3773 and the Colorado AI Act in view.
- 02
Enforced in the product
Several independent layers make sure of it.
- 03
Help only
It assists people. It never gives a score.
04The record
Sensitive actions, on the record.
Sensitive actions, from access changes and data exports to file operations, GDPR requests, legal holds and admin operations, are written to an append-only audit record with who did it, their IP address and the time.
- 01
Multi-factor sign-in
Codes from an authenticator app, on top of the password.
- 02
Roles and permissions
Five workspace roles and twenty-five detailed permissions, with access limited by department.
- 03
Admins are logged too
Admin operations are written to the record too.
05The perimeter
No direct way in from the internet.
The database sits inside a private network and can’t be reached from the internet. The servers accept traffic only through the load balancer, and nobody logs in to them directly. Admin access is restricted and logged.
- 01
Encrypted everywhere
Files, sensitive database fields and secrets are encrypted when stored, and traffic is encrypted when moving.
- 02
AI inside the walls
Every AI request stays inside the same boundary, on enterprise model infrastructure.
- 03
No consumer AI
Nothing ever goes to a consumer AI service.
06Where we stand
Where we stand, in writing.
The same standards on our front door, kept on every page of the product. Where a certification is in progress rather than complete, we say so.
- 01
SOC 2
Controls mapped, with consent tracking, versioned policies and append-only audit records.
Not yet certified - 02
ISO 27001
Encryption, access control and auditing mapped to the standard.
Not yet certified - 03
HIPAA
Not supported, on purpose. No protected health information, and no Business Associate Agreement.
Not supported - 04
GDPR
Erasure and portability are built in.
Implemented - 05
Your data and AI
Never used to train a model, and never sold.
- 06
Audit and encryption
Sensitive actions are recorded, and data is encrypted when stored and when moving.
One system. One review. On the record.
Built for companies that take security seriously, and honest about which badges we have.