Workspace isolation
Every record is scoped to your agency workspace and enforced by row-level access policies.
Trust center
Autonomy only works when you can trust it.
How Wortol protects agency and candidate data, keeps AI accountable and prepares for the EU AI Act.
GDPR
Compliant
EU AI Act
Readiness programme
ISO/IEC 27001
Certification in progress
Compliance status
Where we stand — stated plainly.
These are Wortol's current statements, not third-party assurance badges. Supporting material is shared where available during a security review.
GDPRCompliant
Processing designed around lawful basis, data minimisation, subject rights and a Data Processing Agreement for every customer.
Read the full pageEU AI ActReadiness programme
Recruitment AI is high-risk under the Act. Human oversight, logging, transparency and risk management are built into the product.
Read the full pageISO/IEC 27001Certification in progress
Our information security management system is being implemented toward ISO/IEC 27001 certification.
Read the full pageSecurity
Controls built into the product.
Role-based access
Owners, admins, recruiters and viewers receive different permissions.
Encryption
Data encrypted in transit (TLS) and at rest.
Authentication
Secure sign-in with session management and least-privilege service access.
Audit history
Durable log of agent and human actions on every record.
Approval boundaries
Verified briefs, correctable sourced facts and approved outreach keep consequential actions with people.
GDPR & privacy
Candidate data handled with care.
Wortol acts as processor for your agency. You stay in control of the candidate relationship and their rights.
- Data Processing Agreement available for every customer
- Support for access, rectification and erasure requests
- Data minimisation: agents use what the mission needs
- Agency data is not used to train public AI models
- Sub-processor list available on request
EU AI Act
Designed for high-risk AI obligations.
AI used in recruitment and candidate selection is classified as high-risk. Wortol is built so agencies can meet their deployer duties.
Human oversight
Screening controls, approval requirements and context for human review.
Record-keeping
Automatic logs of agent decisions and their inputs.
Transparency
Source quotes, citations and labelled uncertainty.
Risk management
Stop rules, envelopes and conflict detection by default.
Public facts matrix
What is confirmed—and what requires review.
We do not publish assumptions as security facts. Items without a public answer are confirmed directly for your proposed setup.
Organisation
Public
Wortol B.V., a private limited company under Dutch law.
GDPR role
Public
Wortol acts as processor for agency candidate and client data; the agency remains controller.
Training use
Public
Agency data is not used to train public AI models.
DPA
On request
Available for customer review through legal@wortol.com.
Subprocessors
Security review
The current list is provided for the proposed setup; no list is published on this site.
Hosting and processing regions
Security review
Confirmed for the proposed setup before commitment.
Retention and deletion
Security review
Customer-specific requirements and operational handling are documented during review.
AI providers and provider retention
Security review
Confirmed against the models and processing path proposed for the customer.
Security testing and incidents
Security review
Available evidence and current status are discussed directly; this page makes no unverified claim.
ISO/IEC 27001
In progress
Wortol is not yet certified; implementation is underway ahead of audit.
Responsible AI
Evidence first. No invented facts.
Every Wortol answer and suggestion carries its source — and admits when there isn’t one.
- Fact, inference, conflict and unknown labelled separately
- Every claim linked to a record and exact quote
- Conflicts escalate instead of overwriting
- Matches explained, never a black-box score
FAQ
Questions agencies ask.
Vendor diligence
Bring your security questionnaire.
We will separate public facts, available evidence and open items for your proposed configuration.
Discuss your review