Security you can check, not just trust.
Employment certificates hold some of the most sensitive data a company keeps. This page shows how ZeugnyAI handles it, which controls are in place, which are planned, and where your team can verify each one.
Scope: ZeugnyAI Cloud (app.zeugny.com), the Self-Hosted edition and the Zeugny Engine. ZeugnyAI Chat and the free Certificate Checker are consumer products with their own privacy notices.
Four things we hold ourselves to
- 01
Personal data stays in Switzerland
Employee records, certificates, backups, keys and logs are stored in Azure Switzerland North. Backups and files are also replicated to a second Swiss region, Switzerland West. app.zeugny.com is served directly from Zürich.
- 02
The AI does not see who it writes about
Before a request reaches the engine, the platform replaces names, employers, dates, e-mail addresses and employee IDs with pseudonyms and restores them in the answer. If it cannot do this safely, it refuses the request.
- 03
Your team can read the code
Self-Hosted customers receive the full platform source and build the containers themselves, including the pseudonymisation code that decides what reaches the engine.
- 04
People decide, the AI writes
Managers set the ratings. The AI writes text that matches them and records which rating each sentence expresses. A fairness check and HR finalisation come before anything is issued.
The AI writes about people it cannot identify.
The same passage, before and after the PII boundary. Every replacement is recorded, so the engine's answer can be restored exactly.
Sandra Keller, born on 14 June 1988, joined Aareblick Logistik AG on 1 March 2019 as Team Lead Dispatch. Ms Keller led a team of eight.
Laura Brunner, born on 28 July 1988, joined Nordwerk AG on 14 April 2019 as Team Lead Dispatch. Ms Brunner led a team of eight.
- All dates in a document move by the same offset, so durations and seasons stay correct.
- Job titles, tasks and ratings pass through: the text needs them. Place of birth and nationality, if entered, are sent as written.
- Every crossing is written to the audit trail. HR can inspect counts, payload hashes and pseudonyms for each certificate.
Where personal data goes, and where it stops
Each step is labelled with the kind of data it handles.
- Cloud (Zürich) or your network
HR platform
Employee records, ratings and certificates. All personal data stays here.
Personal data - Cloud (Zürich) or your network
PII boundary
Replaces identities with pseudonyms, records every crossing and refuses what it cannot map.
Pseudonymises - Zeugny Engine
Engine
Composes and checks certificate text, and calls the language models that write it.
Pseudonymised - Model providers
Language models
Microsoft Azure AI Foundry and the other providers listed under Data & subprocessors.
Pseudonymised
Answers travel back the same way. The engine returns text that contains pseudonyms, and the platform puts the real names back before anyone reads it.
What we are building next
Security work is never finished. These are the next steps, together with what already covers each area today.
Independent certification
ISO 27001 certification is on our roadmap. Today, Self-Hosted customers review the source directly, every control on this page states its status, and we answer your security questionnaire.
Independent penetration test
An external test is planned. Self-Hosted customers are welcome to test their own installation at any time; for the managed Cloud we agree scope and timing with you.
Built-in multi-factor sign-in
Single sign-on, switched on in the managed Cloud and connected to your identity provider on request, brings that provider's MFA to every sign-in. Staff accounts in our control plane already require a second factor. A built-in second factor for customer password sign-in is planned.
Retention and deletion for engine records
The engine keeps pseudonymised requests and responses. An automatic retention limit and a customer-facing deletion for these records are planned.
Database-level company isolation
In the managed Cloud the application keeps companies apart, and Self-Hosted gives each customer its own database. Row-level enforcement in the database is planned as a second layer.
Frameworks and where we stand
Each framework shows whether we have assessed ourselves against it or mapped our controls to it, and which controls apply. Independent certification is on our roadmap.