Trust Center
Security and privacy are foundational to everything we build. Learn how we protect your data and maintain your trust.
SOC 2 Ready
Our infrastructure, processes, and controls are designed to meet SOC 2 Type II requirements. We maintain comprehensive security documentation and have undergone an independent external security assessment, with a penetration testing engagement underway.
Key Controls
- Access controls and authentication
- Data encryption at rest and in transit
- Continuous monitoring and alerting
- Incident response procedures
- Vendor risk management
Tenant Isolation
Logical data isolation between organizations. Customer data queries are scoped to your organization at the application layer, with access logging and auditing.
Key Controls
- Row-level tenant scoping on customer data queries
- Role-based access control within each organization
- Access logging and auditing
No-Training AI Policy
We do not use your data to train our AI models. Your HR information, employee conversations, and documents are not used to improve our proprietary AI systems, and third-party AI subprocessors we use are contractually restricted to processing data solely to deliver the service.
Key Controls
- Zero data training policy
- No model fine-tuning on customer data
- AI subprocessors restricted to processing data solely to deliver the service
- Commitments documented in our Terms of Service
- Independent external security assessment; penetration testing underway
Complete Audit Trail
Every action in Eva is logged and auditable. Track user activity, system changes, and access patterns with comprehensive audit logs.
- User login and session tracking
- Document access and modifications
- Configuration and settings changes
- API calls and integrations
- Export and reporting activity
- Filterable by user, action, and date range
Additional Security Measures
Defense in depth across every layer of our platform.
Data Encryption
AES-256 encryption for data at rest. TLS 1.2+ for all data in transit (TLS 1.3 by default).
Access Controls
Role-based access control (RBAC) with granular permissions.
Infrastructure
Hosted on Google Cloud Platform with enterprise-grade security.
Data Backup
Automated daily backups with point-in-time recovery.
Compliance & Certifications
We're committed to meeting the highest standards of data protection and privacy. Our platform is designed to help you meet your regulatory requirements.
Need more information?
Contact Security TeamFrom the blog
EU Pay Transparency: Your Employees Can Now Ask HR About Pay. Can You Answer Consistently?
Article 7 of the EU Pay Transparency Directive lets any worker ask about pay, with a two-month deadline. Here's the HR service problem that creates.
Stress-Test Your HR Team Before Reality Does
Eva HR Lab runs your organization through scenario-based simulations of the conversations that create litigation risk, and scores your team blind against Eva.
The EU AI Act's High-Risk Rules for HR AI Are Now in Force
The EU AI Act's high-risk obligations for employment AI are now active. Here's what changed for hiring, promotion, and monitoring tools, and what HR needs to check first.