Enterprise-grade security
by design.
Security isn't a feature we added later. It's the architecture employeeX was built on from day one.
SOC 2 Type II
employeeX undergoes annual third-party audits by an accredited CPA firm. Our SOC 2 Type II report covers Security, Availability, and Confidentiality trust service criteria. Enterprise customers receive a copy under NDA on request.
Data Encryption
All data is encrypted at rest using AES-256 with per-tenant key management. Data in transit is protected by TLS 1.3. Encryption keys are rotated automatically and stored in a hardware security module (HSM), never in application code.
Microsoft MSAL / SSO
Integrate with your existing identity provider using Microsoft MSAL, Okta, or any SAML 2.0-compatible IdP. MFA is enforced by default on all plans. Just-in-time user provisioning means accounts are created automatically on first login.
Role-Based Access Control
Fine-grained RBAC with hierarchical permission inheritance means every action is explicitly authorised. Roles propagate down your organisational hierarchy, and every API call is verified against the caller's permissions before execution.
PII Detection & Redaction
Automatic detection of personal data — names, emails, phone numbers, national IDs, financial details — in both user inputs and agent outputs. Configurable redaction policies let you mask, replace, or block PII before it reaches the LLM or is stored.
Audit Trails
Every agent action, tool call, knowledge base query, and administrative change is written to an immutable, append-only audit log with the acting user's identity, timestamp, and IP address. Logs are exportable in JSON and CEF formats for SIEM ingestion.
Compliance certifications
SOC 2
Type II
Expected Q1 2027
GDPR
Compliant
Article 28
ISO 27001
In Progress
Expected Q1 2027
HIPAA
Enterprise
Expected Q1 2027
Data residency
Choose where your data lives. Enterprise customers can pin all data — messages, documents, embeddings, and logs — to a specific region. Data never crosses regional boundaries without explicit configuration.
European Union
Frankfurt, Ireland
United States
Virginia, Oregon
Asia-Pacific
Singapore, Sydney
Penetration testing
employeeX undergoes annual penetration tests conducted by independent certified security firms. Our most recent test was completed in January 2025 with all critical and high findings remediated within 14 days.
Last test: January 2025
By NCC Group (CREST accredited)
We maintain a responsible disclosure programme. If you discover a security issue, please email security@employeex.ai.
Contact our security team
For vulnerability reports, compliance questions, or to request our security whitepaper.
security@employeex.aiNext step
See what agents can do for your specific workflows.
Bring your use cases, governance requirements, and tech stack. We'll map the right agent operating model, show you the platform live, and scope a deployment plan your stakeholders can approve.