Snapshot 49211
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Tellent Trust Center Welcome to the Tellent Trust Center. Tellent is the People Decision Platform helping over 7,000 companies across 100+ countries streamline recruitment, HR management, and performance development. Our platform handles sensitive people data at every stage, from collaborative hiring to employee lifecycle management. Built and headquartered in Europe, Tellent is GDPR compliant and ISO certified. We support EU regulations and local labor laws across DACH, Benelux, and France, and apply Standard Contractual Clauses for data transfers outside the EU. Powered by Wolfia. Review compliance certifications, security policies, subprocessors, and request access to detailed documentation. Skip to main content Tellent Trust Center Welcome to the Tellent Trust Center. Tellent is the People Decision Platform helping over 7,000 companies across 100+ countries streamline recruitment, HR management, and performance development. Our platform handles sensitive people data at every stage, from collaborative hiring to employee lifecycle management. Built and headquartered in Europe, Tellent is GDPR compliant and ISO certified. We support EU regulations and local labor laws across DACH, Benelux, and France, and apply Standard Contractual Clauses for data transfers outside the EU. ⌘K OverviewDocumentationControlsSubprocessorsAI Statement Loading content... Certifications Trusted by Staples Framestore bunq TaskHuman Trust center by Wolfia: AI trust center & security questionnaire automation Does your team answer security questionnaires too? Wolfia answers them for you and runs trust centers Documentation Certifications ISO 27001 Certificate SOC 2 Type II Report Security ISO 27001 Statement of Applicability Security, Compliance & Operations Whitepaper Other Penetration Testing Report for Tellent Recruitee and Tellent HR Subprocessors Amazon Web Services · Frankfurt, Germany (AWS: eu-central-1) Cloud Hosting and Infrastructure Frankfurt, Germany (AWS: eu-central-1) Google Cloud Platform · Frankfurt, Germany (GCP: europe-west3), Berlin, Germany (GCP: europe-west10) Cloud Hosting and Infrastructure Frankfurt, Germany (GCP: europe-west3), Berlin, Germany (GCP: europe-west10) Intercom · North Virginia, USA (AWS: us-east-1) Customer Support Tool North Virginia, USA (AWS: us-east-1) Mailgun · Frankfurt, Germany (AWS: eu-central-1) Email Delivery Platform Frankfurt, Germany (AWS: eu-central-1) Textkernel · Germany Document Processing & Parsing Germany Controls Compliance and auditing Independent certifications and continuous audits provide objective assurance that security controls operate effectively ISO 27001:2022 certification SOC 2 Type II attestation Annual internal security audits Formal management review Access control Robust identity and access management safeguards limit system privileges to the right people at the right time Least privilege permissions Two-factor authentication Quarterly access reviews Immediate de-provisioning on termination Data security Encryption, segregation and classification controls protect the confidentiality and integrity of customer information Encryption at rest Encryption in transit Logical tenant segregation Data classification and handling standards Frequently asked security questions Is Tellent secure? Tellent operates this public trust center. It publishes 2 independent compliance certifications, security documentation available on request, and a published list of its subprocessors. Is Tellent SOC 2 compliant? Yes. Tellent maintains SOC 2 Type II compliance. You can review this in the compliance section of this trust center. Does Tellent have ISO 27001 certification? Yes. Tellent is ISO 27001 certified. You can review this certification in the compliance section of this trust center. Who are Tellent's subprocessors? Tellent discloses its subprocessors in this trust center, including amazonwebservices.com, googlecloudplatform.com, and Intercom. See the subprocessors section for the complete list. Where is Tellent data hosted? Tellent discloses its infrastructure and hosting subprocessors in this trust center, including DigitalOcean. See the subprocessors section for details. How do I request Tellent's security documentation? You can request access to Tellent's security documentation directly through this trust center. Submit an access request and the Tellent team reviews and grants access. Trust center by Wolfia: AI trust center & security questionnaire automation Does your team answer security questionnaires too? Wolfia answers them for you and runs trust centers Controls Compliance and auditing Independent certifications and continuous audits provide objective assurance that security controls operate effectively ISO 27001:2022 certification The information security management system is certified to ISO 27001:2022, demonstrating a systematic, externally verified approach to protecting data across development, operations and delivery. SOC 2 Type II attestation An annual SOC 2 Type II report covers security, availability and confidentiality for a full operating year, giving customers third-party validation of control design and effectiveness. Annual internal security audits Internal controls are reviewed each year to verify conformance with policies and identify improvement opportunities before external assessments occur. Formal management review Executive leadership conducts an annual, documented review of security objectives, risks and audit results to ensure the control environment remains aligned with business and regulatory requirements. Access control Robust identity and access management safeguards limit system privileges to the right people at the right time Least privilege permissions Access rights are granted strictly according to job responsibilities and routinely re-evaluated, reducing the attack surface and insider risk. Two-factor authentication All supported systems require a second factor or secure logon mechanism, significantly lowering the likelihood of unauthorized account takeover. Quarterly access reviews Security and system owners review user entitlements every quarter to confirm that privileges remain appropriate and revoke any unnecessary rights. Immediate de-provisioning on termination User accounts are disabled and access revoked as soon as an employee or contractor leaves, preventing lingering access to customer data. Data security Encryption, segregation and classification controls protect the confidentiality and integrity of customer information Encryption at rest Databases containing customer information are encrypted while stored, ensuring data remains unreadable without authorized keys even if physical media are compromised. Encryption in transit All data exchanges occur over encrypted channels such as TLS or VPN to prevent eavesdropping and tampering on public networks. Logical tenant segregation Architectural controls separate each customer’s data from others, ensuring that one tenant cannot access or impact another’s information. Data classification and handling standards Documented classification levels govern how information is stored, processed and shared, aligning protection measures with data sensitivity. Application security A secure development lifecycle and rigorous testing keep the platform resilient against emerging threats Secure development lifecycle Development follows documented processes that integrate security reviews, automated testing and controlled CI/CD pipelines from code commit to deployment. Peer code reviews All code changes are submitted as pull requests and must be reviewed and approved by another developer before merging, catching defects and malicious code early. Automated dependency scanning CI/CD pipelines automatically scan software dependencies for known vulnerabilities, preventing vulnerable libraries from reaching production. Annual penetration testing Independent specialists perform yearly penetration tests, and findings are tracked through remediation to validate external resilience. Incident response Prepared and practiced response capabilities minimize impact when security events occur Documented incident response plan A formal plan defines processes for detecting, triaging, containing and resolving security incidents, ensuring swift, coordinated action. Assigned response roles and responsibilities A dedicated incident response team with clear duties and contact protocols is established to manage events from investigation through resolution. Root-cause analysis and lessons learned Post-incident reviews capture lessons and drive control improvements to reduce the likelihood of recurrence. External breach communication procedures Defined processes ensure timely notification to customers, authorities and other stakeholders if a breach of personal data or service disruption occurs. Business continuity and disaster recovery Redundant design, tested backups and comprehensive plans keep services available despite disruptive events Business continuity plan A company-wide continuity plan, reviewed annually, outlines strategies to maintain critical operations and customer support during emergencies. Automated backups with quarterly restore tests Customer data is backed up automatically and validated by quarterly restoration tests, confirming data can be recovered within agreed timeframes. Geographic redundancy and failover Core infrastructure runs in multiple regions, and cloud providers perform regular failover testing to safeguard against regional outages. Capacity monitoring with threshold alerts System capacity and resource utilisation are continuously monitored with alerting on predefined thresholds to enable proactive scaling and prevent performance degradation. Infrastructure security Layered technical safeguards defend the cloud environment and networks hosting the service Network segmentation and firewalls Production systems are isolated behind firewalls and segmented networks, limiting lateral movement and exposure to threats. VPN-protected administrative access Direct server access from outside corporate offices requires VPN authentication, adding an extra barrier against unauthorized intrusion. Technical boundary protection Firewalls, load balancers and rate-limiting gateways protect service endpoints from malicious traffic and denial-of-service attacks. Infrastructure monitoring and alerting Automated tools watch key infrastructure metrics and trigger alerts so engineers can respond quickly to anomalies or failures. Employee security Human-centric controls reduce insider risk and build a culture of security awareness Security awareness training All staff complete security training during onboarding and at least annually thereafter, reinforcing responsibilities for protecting customer data. Pre-employment background checks Criminal background screening is performed for roles with access to information assets, adding assurance about personnel trustworthiness. Code of conduct and disciplinary process A formal code of conduct sets expectations for ethical behaviour and outlines consequences for policy violations, promoting accountability. Clean desk and clear screen policy Workspaces must be kept free of sensitive material and screens locked when unattended, reducing the chance of casual data exposure. Vendor and third-party management Due diligence and contractual safeguards manage risks arising from external service providers Vendor risk assessments New suppliers are vetted by legal and security teams before use, and risk levels dictate ongoing oversight requirements. Data processing agreements Critical vendors must sign DPAs that define privacy obligations and security measures in line with data protection laws. Annual review of third-party assurance reports SOC and other audit reports from cloud and infrastructure providers are obtained and evaluated yearly to confirm continued control effectiveness. Termination and SLA clauses Standard contracts include clear service-level and termination provisions, enabling enforcement or exit if a vendor fails to meet security expectations. Monitoring and logging Comprehensive telemetry and protected logs provide visibility into security and operational events Centralised audit logging System activities are logged to dedicated repositories isolated from production systems, preserving integrity for investigations and compliance. Continuous infrastructure and application monitoring Real-time monitoring covers performance, availability and security metrics, enabling rapid detection of issues. Anomaly detection on endpoints Company devices and the platform use monitoring agents that flag suspicious behaviour for security team review. Separate log storage Logs are stored in systems that prevent unauthorised modification or deletion, ensuring reliable evidence for audits. Change management Controlled processes ensure that all modifications to systems are secure, tested and traceable Documented change procedures Infrastructure and application changes follow formal workflows covering planning, approval, testing and documentation. Controlled release process Only authorised personnel can deploy code to production, and each release is recorded for auditability. Rollback capability Deployment pipelines retain previous versions so services can quickly revert if issues arise, protecting availability. Quality assurance testing Changes undergo QA, including checks for malicious code, before they are accepted into the production environment. Physical security Facility and asset protections prevent unauthorised physical access and data leakage Controlled office access Entry to company offices requires authorised access cards or locks, limiting exposure of systems and information. Secure asset lifecycle management Devices are tracked, encrypted, wiped before reuse and securely stored or disposed of when retired, protecting data on hardware. Endpoint disk encryption Company laptops and mobile devices use full-disk encryption, preventing data recovery if devices are lost or stolen. Certified data centres Cloud infrastructure resides in ISO 27001 and SOC-audited data centres with strong physical controls, adding an extra layer of assurance. Customer data lifecycle Automated features empower customers and ensure data is retained only as long as necessary Automated retention and deletion Data processed on behalf of customers is automatically removed once contractual retention periods expire, supporting compliance obligations. Self-service data restoration Customers can restore deleted candidate data within seven days, providing convenience and mitigating accidental loss. Data loss prevention monitoring DLP tools monitor and control external sharing of information, reducing the risk of unintended data leakage. Structured backup management Backups include both data and application components, ensuring full restoration capability in the event of corruption or loss. Governance and risk management Defined structures and periodic assessments keep security aligned with business objectives Annual risk assessments A formal process identifies and prioritises risks each year, with treatment plans approved by the board. Monthly security governance meetings Cross-functional teams review incidents, risks and control changes every month to maintain continuous oversight. Board oversight of security The board of directors receives regular updates and provides guidance on security strategy and performance. Fraud risk analysis Risk assessments explicitly consider fraud scenarios, and mitigating measures are implemented and reviewed. Privacy and data protection Policies, agreements and technical measures align service operations with global privacy requirements Defined GDPR roles The organisation clearly distinguishes processor and controller responsibilities, ensuring lawful processing of personal data. Customer data processing agreements Standard DPAs embed Article 28 GDPR requirements and set out technical and organisational measures for protecting personal data. Secure data transmission methods Sensitive information is sent using approved secure protocols, preventing interception over public networks. Confidential data handling rules Staff follow documented procedures for storing, transmitting and disposing of confidential information, reducing privacy risk. Documentation Certifications ISO 27001 Certificate SOC 2 Type II Report Security ISO 27001 Statement of Applicability Security, Compliance & Operations Whitepaper Other Penetration Testing Report for Tellent Recruitee and Tellent HR Annual Financial Report Core Sub-processors Amazon Web Services · Frankfurt, Germany (AWS: eu-central-1) Cloud Hosting and Infrastructure Frankfurt, Germany (AWS: eu-central-1) Google Cloud Platform · Frankfurt, Germany (GCP: europe-west3), Berlin, Germany (GCP: europe-west10) Cloud Hosting and Infrastructure Frankfurt, Germany (GCP: europe-west3), Berlin, Germany (GCP: europe-west10) Intercom · North Virginia, USA (AWS: us-east-1) Customer Support Tool North Virginia, USA (AWS: us-east-1) Mailgun · Frankfurt, Germany (AWS: eu-central-1) Email Delivery Platform Frankfurt, Germany (AWS: eu-central-1) Textkernel · Germany Document Processing & Parsing Germany Other Sub-processors Affinda · Frankfurt, Germany (AWS: eu-central-1) Document Processing & Parsing Frankfurt, Germany (AWS: eu-central-1) HirePort · Germany, Netherlands ATS Integrations Germany, Netherlands Kombo · Germany, Netherlands Unified API Platform Germany, Netherlands Microsoft Azure · The Netherlands (Azure: West Europe), Sweden (Azure: Sweden Central), Germany (Azure: Germany West Central) API Integrations, WhatsApp Hiring Integrations The Netherlands (Azure: West Europe), Sweden (Azure: Sweden Central), Germany (Azure: Germany West Central) Sentry · Germany Application Monitoring Germany VONQ · Ireland, Germany, Netherlands ATS Integrations Ireland, Germany, Netherlands Ziggeo · Ireland (AWS: eu-west-1) Video Technology Platform Ireland (AWS: eu-west-1) Tellent HR Sub-processors Mailjet · Belgium, Germany Email Delivery Platform Belgium, Germany Postmark · Worldwide Email Delivery Platform Worldwide WhatsApp Hiring Sub-processors DeepL · Germany Translation Tool Germany DigitalOcean · Germany Cloud Hosting and Infrastructure Germany Meta · Germany WhatsApp Provider Germany Loading content... Updates Overview