Compliance & Certifications
Our current compliance posture and certifications in place.
We are currently in our SOC 2 observation period. Type I audit is targeted for Q3 2026, with Type II certification planned for Q1 2027. Our controls are monitored continuously via automated compliance tooling.
Staffinity processes data in accordance with GDPR requirements. Data Processing Agreements (DPAs) are available for all clients. EU–US transfers use Standard Contractual Clauses (SCCs).
Request DPAStaffinity complies with California Consumer Privacy Act requirements. We do not sell or share personal information. California residents may submit data requests to privacy@staffinity.io.
Your CA RightsStaffinity offers a HIPAA-ready deployment option for healthcare clients, including PHI detection, circuit breaker controls, and Business Associate Agreements (BAAs) for covered entities and business associates.
Request BAAEnterprise AWS Infrastructure
Built on AWS with enterprise-grade controls at every layer.
AWS Well-Architected Framework Review
Our infrastructure has been independently reviewed against all six pillars of the AWS Well-Architected Framework. Zero high-risk findings across every pillar.
Per-Client Data Isolation
Every Staffinity client runs in dedicated infrastructure — separate ECS clusters, isolated databases, and client-specific encryption keys. Your data is never co-mingled with another client's data, at any layer of the stack.
AI Provider Commitments
We are transparent about every AI provider we use and their data handling commitments.
| Provider | Role | Data Commitment | Certification |
|---|---|---|---|
Anthropic Claude AI |
Primary AI model for agent responses and reasoning | Data is not used to train shared models. Enterprise data processing agreement in place. ✓ No shared model training |
Enterprise DPA |
Amazon Web Services Infrastructure |
Cloud infrastructure, storage, compute, and networking | Data processed under AWS standard DPA. Covered under AWS Enterprise Agreement. ✓ SOC 2 Type II Certified |
SOC 2 Type II |
Microsoft Azure Teams / Identity |
Teams platform integration and Azure AD identity management | Data processed under Microsoft Enterprise Agreement and DPA. ✓ ISO 27001 Certified |
ISO 27001 |
Perplexity AI Web Search |
Web search capability for agents requiring real-time information | Used for search queries only. No conversation content or personal data is transmitted to Perplexity. ✓ No conversation data shared |
Limited Scope |
Our Compliance Roadmap
A transparent view of where we are and where we're going.
Security Questions?
We're transparent. Reach out any time.