Security and compliance
HR and recruiting AI agents: SOC 2, ISO 27001, GDPR and SSO
We checked 7 HR and recruiting AI agents against their makers' own pages. 0 hold SOC 2, 0 hold ISO 27001, 6 state GDPR or offer a DPA and 1 offer SSO with no plan limit.
| HR and recruiting AI agents | SOC 2 | ISO 27001 | GDPR / DPA | SSO |
|---|---|---|---|---|
| BlostoChecked | Not stated | Not stated | Yes | PartlyScale plan and up |
| HeyMilo AIChecked | Partly | Not stated | Partly | Yes |
| HumanlyChecked | Not stated | Not stated | Yes | Not stated |
| JuiceboxChecked | Not stated | Not stated | Yes | PartlyBusiness plan and up |
| NeverApplyChecked | Not stated | Not stated | Yes | Partly |
| Paradox (Olivia)Checked | Not stated | Not stated | Yes | Not stated |
| RecruiterflowChecked | Not stated | Not stated | Yes | Partly |
"Checked" is the oldest answer in the row. "Not stated" means the maker's pages don't say either way.
- SOC 2
- Holds a SOC 2 report, Type I or Type II.
- ISO 27001
- Is certified to ISO/IEC 27001.
- GDPR / DPA
- States GDPR compliance or offers a data processing agreement.
- SSO
- Lets a team sign in through its own identity provider (SAML or OIDC), with the plan it comes on.
The "Partly" answers
- Blosto, SSO: Single sign-on and access controls are named only for the custom-priced Scale plan, so Starter and Team buyers do not get identity-provider login. Source,
- HeyMilo AI, SOC 2: Beyond SOC 2, the vendor claims GDPR, PIPEDA, Quebec Law 25 and CASL compliance, monthly third-party bias audits against NYC Local Law 144, a Data Protection Officer and EU AI Act classification work. Source,
- HeyMilo AI, GDPR / DPA: Beyond SOC 2, the vendor claims GDPR, PIPEDA, Quebec Law 25 and CASL compliance, monthly third-party bias audits against NYC Local Law 144, a Data Protection Officer and EU AI Act classification work. Source,
- Juicebox, SSO: SAML single sign-on with Okta or Microsoft Entra ID exists but only on the Business plan, and setup runs through the Juicebox team with one-time links rather than self-service; SCIM provisioning is documented too. Source,
- NeverApply, SSO: Consumer social sign-in with Google or LinkedIn plus optional two-factor, but no SAML or enterprise OIDC federation is offered anywhere. Source,
- Recruiterflow, SSO: Google and Outlook sign-in are documented as the standard way in, with a Recruiterflow password as fallback; no SAML or other identity provider is described. Source,
Use the data
How we check listings: methodology.