Security, privacy, and responsible AI for modern recruiting.
Marty protects candidate data, supports your compliance obligations, and gives security and legal teams the evidence they need.
- EU data residency
- Hosted in the EU, in Frankfurt, with backups in Dublin.
- ISO 27001 certified
- By TÜV Nord
- GDPR ready out of the box
- DPA, SCCs, retention rules
- 99.9% Uptime SLA
- per calendar quarter
Certifications, reports, and legal documents
Security evidence, legal paperwork, and AI governance materials, grouped by team. Contact us to request the documents you need.
For security teams
- ISO 27001 certificateOn request
- Penetration test summaryOn request
- Vulnerability disclosure policyOn request
- Security white paperOn request
For legal and privacy teams
- Data processing agreementOn request
- Subprocessor listOn request
- Privacy policyOn request
- Records of processingOn request
- DPIA materialsOn request
For AI governance teams
- AI documentation packOn request
- AI principlesOn request
- Bias audit statementOn request
- Model and data governance overviewOn request
How the system is protected
A full-time security team runs the programme: defence in depth, aligned to ISO 27000. The full control register is below.
Control register
Active as of September 2026
- Device encryption
- All data stored locally on company devices is encrypted.
- Background checks
- Run before employment, within what local law permits.
- Secure remote access
- Administration happens only over a dedicated VPN, and short session timeouts plus context-aware rules mean only managed, hardened laptops reach internal systems.
- Security training
- Awareness training for everyone, plus role-specific training for engineers.
- Least privilege
- Named individual accounts only, reviewed annually; production access sits behind hardware security keys.
- Single sign-on and provisioning
- SAML 2.0 with Okta, Entra ID, and Google Workspace; SCIM keeps seats and roles in sync.
- Multi-factor authentication
- Available on every account and enforceable workspace-wide.
- Role-based permissions
- Projects and sender accounts are public to your team or private to named colleagues.
- Audit logs
- Exportable record of access, changes, and deletions.
- Encrypted in transit
- TLS 1.2 and 1.3 with the strongest available cipher, enforced by HSTS.
- Encrypted at rest
- AES-256 across databases, object storage, and backups.
- Password hashing
- Credentials are salted and hashed; never stored in plain text.
- Key management
- Keys held in a managed KMS with rotation and split access.
- Data centre access control
- Hosting runs in ISO 27001-certified EU facilities with escorted, logged physical access.
- Environmental safeguards
- Fire detection and suppression, redundant power with UPS and generators, climate control.
- Tenant and environment isolation
- Logical separation at every layer, and production, staging, and test environments stay fully segregated.
- Network defence
- WAF, DDoS filtering, and DNSSEC in front of the application.
- Uptime SLA and status page
- A 99.9% uptime commitment per calendar quarter, with real-time availability and incident history published publicly.
- Data redundancy
- Encrypted backups run hourly to weekly by data type, with point-in-time recovery.
- Infrastructure redundancy
- Multi-zone EU deployment with synchronous replicas and automatic failover.
- Auto-scaling
- Capacity follows load, so hiring peaks don’t degrade performance.
- Vulnerability scanning
- Continuous scanning of code, dependencies, and infrastructure, with severity-based remediation timelines and retesting before release.
- Penetration testing
- Annual external test plus internal testing through the year; summary available under NDA.
- Monitoring and detection
- Centralised logging across production with 24/7 alerting to on-call.
- Responsible disclosure
- A published policy and a triage commitment for good-faith researchers.
- Incident response plan
- Documented plan covering triage, containment, and post-mortem, rehearsed annually.
- Escalation path
- On-call rotation with a defined route to security and privacy leads.
- Customer notification
- Affected customers are notified in writing within 24 hours of discovery.
- Business continuity plan
- Policies for keeping customer-facing services running through a prolonged disruption.
- Disaster recovery plan
- Recovery procedures with agreed RTO and RPO targets, owned by the security lead.
- Restore testing
- Backups are test-restored on a schedule.
- Due diligence
- Every subprocessor is reviewed for security and privacy before it touches customer data.
- Published subprocessor list
- Kept current, with advance notice of changes.
- Contractual safeguards
- Data processing terms and confidentiality obligations flow down to every vendor.
Partner security assessments
As a trusted integration partner, Marty undergoes annual scoped technical assessments conducted by industry leaders including Google and Microsoft to maintain our integration partnerships and ensure we meet their strict requirements.
- Annual scoped assessment covering API access, OAuth scopes, and data handling.
- Microsoft
- Annual scoped assessment against partner requirements for Entra ID and Graph integrations.
Regulatory support
What the product does for each framework you’re asked about.
- GDPREU & UK
Automated privacy notices, retention windows, and deletion requests.
DPA available
- CCPA / CPRACalifornia
Data handling and policy access managed for candidate data.
Addendum in terms
- EU AI ActEU
Sourcing and evaluation treated as high-risk: documented, tested, human-decided.
Documentation pack
International data governance
Your data stays in Europe unless you choose otherwise.
- EU hosting
- Hosted in the EU, in Frankfurt, with backups in Dublin.
- Standard contractual clauses
- In place with every subprocessor
- Transfer impact assessments
- Run before any transfer outside the EU or UK
- Subprocessor assessments
- Due diligence plus 30 days’ notice of changes
Compliant outreach
Sourcing at scale only works if every message is lawful
- Suppression lists
- Block by candidate, company, or country across every sequence and seat.
- Instant opt-out
- One request stops all future outreach and logs the timestamp.
- Country-level rules
- Local outreach restrictions applied automatically by candidate location.
- Sending limits
- Per-channel daily caps, delays, and cooldowns keep volume acceptable.
AI you can trust
Marty’s AI is built to make recruiters faster and more confident. Every score is explainable, and every decision is yours.
What AI does in Marty
- Surfaces and ranks candidates that match a role
- Drafts outreach messages a recruiter reviews before sending
- Records and summarises interviews, with the candidate's agreement.
What it never does
- Reject, shortlist, or hire without a person deciding
- Infer emotion, personality, or protected characteristics
- Train models on your workspace data
Recruiters stay in control
Marty AI does not make hiring decisions. Recruiters set the criteria, review every result, and make every call. The AI surfaces and ranks; you decide.
Proactive guardrails
PII is removed before AI processing. Marty flags EEO-sensitive inputs and warns against subjective criteria, so your process stays fair and defensible from the start.
Audited and compliant
Marty undergoes third-party bias auditing through BABL, with annual reviews and internal governance processes to ensure our AI meets the highest standards for responsible hiring.
Verified results
No black-box scoring. Every match score includes clear reasoning that recruiters can read, question, and edit, so your team always understands why a candidate ranked where they did.
Where recruiting sits under the AI Act
- UnacceptableSocial scoring, emotion inference. Banned, and not something Marty does.
- High-riskSourcing, screening, evaluation. This is where recruiting sits and where the obligations apply.
- LimitedChat and message drafting. Requires disclosure to the candidate.
- MinimalSpam filtering, deduplication. No additional obligations.
Application dates
- 1 Aug 2024Regulation entered into force
- 2 Feb 2025Prohibited practices and AI literacy obligations apply
- 2 Aug 2025General-purpose AI and governance rules apply
- 2 Aug 2026High-risk obligations for employment and recruiting systems apply
- 2 Aug 2027Remaining high-risk categories in regulated products apply
The AI documentation pack is available on request.
AI principles · Bias audit statementRecorded interviews
See AI NotetakerAI Notetaker records an interview only after the candidate agrees, and candidates can say no without affecting their application.
You set how long recordings, transcripts and notes are kept, and deleting a candidate deletes all three. Marty never rates a candidate from an interview, and doesn't analyse emotion, tone of voice or personality.
Questions we get asked
Sorted the way security reviews usually run.
Still need something?
Our security team answers questionnaires within two business days.
security@marty.hrReady to run security review?
Get the full documentation pack and a walkthrough with our security lead.