your data. our most important workload
entomo runs on the trust of Fortune 500 enterprises and governments. that trust is earned every day — through certified controls, transparent AI, and security engineered into every layer of the platform.
the standards we hold ourselves to
entomo is designed to meet the most rigorous global standards for data security, privacy, and operational resilience — and certified to ISO/IEC 27001:2022 by DNV.
ISO/IEC 27001:2022
certificate C849530, valid to December 2026
SOC 2
compliant
GDPR
EU data protection regulation
CCPA
california consumer privacy
NPC Philippines
registered with the national privacy commission
the ISO/IEC 27001:2022 certificate is held by Entomo GTDIC Private Limited, Bangalore, and covers the design, development, implementation and support of our software products. the NPC certificate of registration (PIC-004-116-2026, effective until 31 March 2027) is held by Entomo Malaysia Sdn Bhd under the Philippines Data Privacy Act of 2012.
defense in depth, by design
security at entomo isn't a feature bolted on — it's engineered into every layer, from the agent runtime to the application surface to the data store.
data protection
customer data is segmented, isolated, and protected with strict access boundaries — across every tenant, every region, every workload.
- tenant isolation at the database and application layers
- field-level encryption for sensitive HR data
- configurable data masking and role-based redaction
- continuous backup with point-in-time recovery
identity & access
enterprise identity built in. every login, every session, every action — verified, scoped, and logged.
- SSO via SAML 2.0 and OpenID Connect
- SCIM-based user provisioning and deprovisioning
- multi-factor authentication and session policies
- granular role-based access control with least-privilege defaults
infrastructure security
encryption everywhere, segmented networks, hardened cloud — with 24×7 monitoring and tested incident response.
- AES-256 encryption at rest, TLS 1.2+ in transit
- private VPCs, network segmentation, WAF protection
- 24×7 security operations center and SIEM coverage
- tested incident response and disaster recovery playbooks
application security
secure-by-design SDLC, automated scanning, and regular third-party testing — so vulnerabilities are caught before they ship.
- annual third-party penetration testing
- SAST, DAST, and dependency scanning in CI/CD
- secure code review and OWASP-aligned controls
- bug bounty program and responsible disclosure channel
your data stays yours. always
employee data is among the most sensitive a company holds. entomo treats it accordingly. customers control where their data lives, how long it's retained, and who can access it — with documented procedures for right to access, correction, and deletion.
we offer regional hosting across multiple geographies so your data stays within your jurisdiction. retention is configurable, audit logs are immutable, and data subject requests are processed through documented workflows aligned to GDPR, CCPA, and local privacy laws.
we are a data processor, not an owner. your data is yours.
data residency options
-
Indiain-country hosting for regulated industries
-
Southeast AsiaSingapore region for SEA customers
-
Middle EastUAE and KSA hosting available
-
European UnionGDPR-aligned EU region hosting
agentic AI you can audit, govern, and trust
entomo is an agentic intelligence platform — and that means our AI safety bar is higher, not lower. every agent action is logged, governed, and bound to your data boundaries.
no training on customer data
your data is never used to train foundation models. agent reasoning is grounded in your context at runtime — and that context never leaves your boundary.
full audit trails
every agent decision, recommendation, and action is logged with inputs, reasoning, and outcome — so HR, IT, and compliance can trace exactly what happened and why.
bias monitoring & controls
agent outputs in performance, hiring, and promotion decisions are continuously monitored for bias drift across demographic groups — with adjustable guardrails customers control.
customer-controlled boundaries
you define which data agents can read, which actions they can take, and which decisions require human approval. agents operate inside your boundaries — never outside them.
grounded outputs, no hallucination
agents cite their sources. recommendations are grounded in your workforce data and policies — not made up. when context is missing, the agent asks rather than guesses.
human-in-the-loop by default
high-stakes decisions — promotions, terminations, performance flags — surface to a human reviewer. automation accelerates work; people stay accountable.
found something? we want to hear
security is a partnership. we work openly with researchers, customers, and the broader community to find and fix issues fast. responsible disclosure is welcome — and rewarded.
if you believe you've found a vulnerability in any entomo product or service, please report it through our coordinated disclosure channel. we acknowledge submissions within two business days, triage within five, and provide regular updates until resolution.
report a vulnerability
security@entomo.coplease do not publicly disclose the issue until we've had a chance to investigate and remediate. we follow industry-standard coordinated disclosure timelines and credit researchers in our advisories.
trust, documented and verifiable
our certificates are above. for our answers to your security questionnaire, our penetration test summary, or a conversation about enterprise compliance, talk to the security team.