# HR and recruiting AI agents: SOC 2, ISO 27001, GDPR and SSO

We checked 7 HR and recruiting AI agents against their makers' own pages. 0 hold SOC 2, 0 hold ISO 27001, 6 state GDPR or offer a DPA and 1 offer SSO with no plan limit.

| Product | SOC 2 | ISO 27001 | GDPR / DPA | SSO | Checked |
| --- | --- | --- | --- | --- | --- |
| [Blosto](https://agentsindex.ai/blosto) | Not stated | Not stated | Yes | Partly (Scale plan and up) | 2026-10-26 |
| [HeyMilo AI](https://agentsindex.ai/heymilo-ai) | Partly | Not stated | Partly | Yes | 2026-10-26 |
| [Humanly](https://agentsindex.ai/humanly) | Not stated | Not stated | Yes | Not stated | 2026-10-26 |
| [Juicebox](https://agentsindex.ai/juicebox-peoplegpt) | Not stated | Not stated | Yes | Partly (Business plan and up) | 2026-10-26 |
| [NeverApply](https://agentsindex.ai/neverapply) | Not stated | Not stated | Yes | Partly | 2026-09-29 |
| [Paradox (Olivia)](https://agentsindex.ai/paradox-olivia) | Not stated | Not stated | Yes | Not stated | 2026-10-26 |
| [Recruiterflow](https://agentsindex.ai/recruiterflow) | Not stated | Not stated | Yes | Partly | 2026-11-01 |

"Checked" is the oldest answer in the row. "Not stated" means the maker's pages don't say either way.

- **SOC 2**: Holds a SOC 2 report, Type I or Type II.
- **ISO 27001**: Is certified to ISO/IEC 27001.
- **GDPR / DPA**: States GDPR compliance or offers a data processing agreement.
- **SSO**: Lets a team sign in through its own identity provider (SAML or OIDC), with the plan it comes on.

## The "Partly" answers

- **Blosto, SSO**: Single sign-on and access controls are named only for the custom-priced Scale plan, so Starter and Team buyers do not get identity-provider login. ([source](https://www.blosto.com/blosto-vs-juicebox), 2026-10-26)
- **HeyMilo AI, SOC 2**: Beyond SOC 2, the vendor claims GDPR, PIPEDA, Quebec Law 25 and CASL compliance, monthly third-party bias audits against NYC Local Law 144, a Data Protection Officer and EU AI Act classification work. ([source](https://www.heymilo.ai/responsible-ai), 2026-10-26)
- **HeyMilo AI, GDPR / DPA**: Beyond SOC 2, the vendor claims GDPR, PIPEDA, Quebec Law 25 and CASL compliance, monthly third-party bias audits against NYC Local Law 144, a Data Protection Officer and EU AI Act classification work. ([source](https://www.heymilo.ai/responsible-ai), 2026-10-26)
- **Juicebox, SSO**: SAML single sign-on with Okta or Microsoft Entra ID exists but only on the Business plan, and setup runs through the Juicebox team with one-time links rather than self-service; SCIM provisioning is documented too. ([source](https://docs.juicebox.ai/help/account/sso-setup.md), 2026-10-26)
- **NeverApply, SSO**: Consumer social sign-in with Google or LinkedIn plus optional two-factor, but no SAML or enterprise OIDC federation is offered anywhere. ([source](https://neverapply.co/privacy), 2026-09-29)
- **Recruiterflow, SSO**: Google and Outlook sign-in are documented as the standard way in, with a Recruiterflow password as fallback; no SAML or other identity provider is described. ([source](https://help.recruiterflow.com/en/articles/5043267-set-a-recruiterflow-password-and-sign-in-with-it), 2026-11-01)

How we check listings: [methodology](https://agentsindex.ai/methodology/).

Source: AgentsIndex, https://agentsindex.ai/data/hr-and-recruiting-ai-agents-security/