Security and Trust
SOC 2 Type II certified, 99.9% uptime, and the detail behind both
Employee data is the most sensitive data your organisation holds, and employee relations casework is the most sensitive part of that. Here is the posture, stated plainly, before you send the questionnaire.
SOC 2
Type II AICPA certification
For the Dovetail HR SaaS product, alongside EU-U.S. with UK Extension and Swiss-U.S. Data Privacy Framework certification.
99.9%
Uptime for HR operations
Hosted on AWS across physically separate availability zones with real-time cross-region replication.
1M+
Security events monitored annually
Continuous monitoring with alerting to key personnel, plus regular third-party penetration testing.
Certifications and attestations
Independently assessed, not self declared
AICPA SOC 2 Type II
Achieved for the Dovetail HR SaaS product. Report available under NDA.
SOC 2 Type II
Data Privacy Framework
Certified under the EU-U.S. Data Privacy Framework including the UK Extension, and the Swiss-U.S. Data Privacy Framework.
EU-U.S. / UK / Swiss
Penetration testing
Dovetail works with third-party experts for regular penetration testing, systematically uncovering and addressing vulnerabilities.
Third party
EU GDPR
Compliant with EU GDPR and US data privacy protection laws and regulations, with third-party providers held to the same standards.
GDPR
Controls in place
How the data is actually protected
Encryption at rest
AES-256, with encryption keys managed through AWS Key Management Service rather than by hand.
AES-256 + AWS KMS
Encryption in transit
TLS 1.2 or 1.3 for HTTP and SSH for SFTP. Optional PGP encryption for SFTP file transfers.
TLS 1.2 / 1.3
Authentication
SAML v2 single sign-on with multi-factor authentication, preventing login sharing and session hijacking.
SAML v2 + MFA
Authorisation
Role-based access control, with access rights adjusted dynamically as the organisation changes.
Role based
Monitoring
Over one million security events monitored annually, with alerting to key personnel for prompt response.
1M+ events/yr
Continuity
Backup strategies and disaster recovery processes designed for rapid recovery, including from ransomware.
DR and backup
Data residency
You choose the region, and it stays there
Our hosting facilities are aligned with data residency in mind. You specify whether your data is hosted in our US or European data centres, and it will reside there even in a situation where a back-up hosting facility is required.
- Customer choice of US or European data centres
- Data remains in the designated region, including during failover
- Physically separate AWS availability zones within your region
- Customer-configurable retention schedules
Employee relations data
The most sensitive records you will hold
ER casework carries confidentiality obligations that general HR case data does not. These controls are specific to it.
Case level restriction
Visibility controlled at case, category and team level, entirely separately from general HR case management.
Restricted
Audit integrity
Hiding a note changes its visibility, not its presence in the audit record.
Immutable record
Retention by policy
Customers can establish retention schedules rather than accepting a vendor default.
Configurable
Privacy tooling
Subject access, retention and erasure support for employee data under GDPR.
GDPR tooling
Common questions
Are you SOC 2 certified?
Yes. Dovetail has achieved Type II AICPA SOC 2 certification for the Dovetail HR SaaS product. The report is available under NDA.
Can we choose where our data is hosted?
Yes. You specify whether your data resides in our US or European data centres, and it stays in that region even where a back-up hosting facility is required.
How is data encrypted?
AES-256 at rest with keys managed in AWS Key Management Service. TLS 1.2 or 1.3 in transit for HTTP, SSH for SFTP, and optional PGP for SFTP file transfers.
Do you support MFA?
Yes. SAML v2 single sign-on with multi-factor authentication, which keeps authentication, geo-fencing and MFA policy under your control.
What is your uptime?
99.9% for secure HR operations, on AWS infrastructure across physically separate availability zones with real-time replication to geographically separate regions.
Do you carry out penetration testing?
Yes. Dovetail collaborates with third-party experts for regular penetration testing, in addition to the compliance programmes of our data centre provider.
Can we set our own retention schedules?
Yes. Customers can establish retention schedules for their data rather than accepting a vendor default.
What international transfer mechanisms do you rely on?
Certification under the EU-U.S. Data Privacy Framework including the UK Extension, and the Swiss-U.S. Data Privacy Framework.
Send us the questionnaire
Ask for the SOC 2 report, the Data Privacy Framework notice, the cybersecurity whitepaper and the current penetration test summary. We would rather do this up front than three weeks into your cycle.