Skip to content
Humaniwork

Trust and compliance

Everything a Data Protection Officer needs, on one page.

This page exists so that the review can start before the first meeting. If something here is not sufficient for your assessment, write to dpo@humaniwork.com and say what is missing.

Some items below describe the platform as it is built and specified. Where a control is specified but not yet exercised in a live client deployment, the page says so.

01 · Data flow

Where the personal data stops.

Anonymisation happens at step 02, at the ingestion boundary. No individual-level record reaches the AI processing layer. The rule is enforced at the pipeline level, which means it cannot be bypassed by writing a different query.

  1. 01Personal data

    Source

    Municipal administrative data, employer workforce data, and public series from INE, Idescat, SEPE, and Social Security.

  2. 02Personal data

    Ingestion boundary

    Personal identifiers are stripped or pseudonymised here. This is where personal data stops. Language is recorded as a first-class field at this point, not inferred later.

    ← Anonymisation boundary

  3. 03Aggregated

    Aggregation

    Records are aggregated to neighbourhood and cohort level against pinned boundary definitions. A minimum cell size is applied at query time, across every filter combination, including exports.

  4. 04Aggregated

    Analysis

    Indicators, matching, and simulation run on aggregated and pseudonymised data only. Every derived figure carries its provenance: source dataset, source version, transformation version, model version, and computed-at timestamp.

  5. 05Aggregated

    Output

    Alerts, shortlists with explanations, reports, and exports. Every output persists the inputs and features that produced it, and its confidence value.

Source: Humaniwork data protection impact assessment, versioned, 2026

02 · EU AI Act

Classified per module, before deployment.

The modules are not equivalent, so a single classification for the platform would be inaccurate. Each classification and the reasoning behind it is versioned in the repository and ships with the release. A reviewer can read the reasoning, not only the conclusion.

EU AI Act classification, per module

ModuleClassificationWhat that means in practice
01 Workforce MatchingHigh-risk obligationsEmployment-related matching is treated under the high-risk obligations: risk management, data governance, logging, human oversight, transparency, and accuracy documentation. The classification and its reasoning are versioned in the repository and ship with every release.
02 Social ObservatoryAdvisory decision-supportCivic analysis is advisory decision-support for an institution. It produces no individual-level output and no automated decision. The classification and its reasoning are versioned in the repository.
03 Integration IntelligenceAdvisory decision-supportAdvisory decision-support at cohort level. No individual-level output, no automated decision. Classification versioned in the repository.
04 Policy SimulatorAdvisory decision-supportSimulation output is advisory decision-support and is labelled modelled everywhere it appears. Classification versioned in the repository.
05 Employer IntelligenceAdvisory decision-supportCohort-level analytics with an aggregation floor applied at query time. It produces no individual-level risk score and cannot be filtered down to one. Classification versioned in the repository.

Source: Humaniwork compliance repository, versioned per release, 2026

03 · Data residency

EU jurisdiction, named region.

Platform compute and storage
Amazon Web Services, EU (Paris, eu-west-3).
Marketing site
Vercel, EU (Frankfurt, fra1). The data residency claim is true of this site as well as of the platform, which is why no function on it runs in a US region.
Catalan deployments
Catalan data residency where the engagement requires it, agreed and recorded in the DPA before ingestion.
Sub-processors outside the EU
None. Adding one would require a documented decision recorded in the compliance repository and communicated to every client DPO in advance.

04 · The DPA process

Signed before a record moves.

  1. Day 0

    Your DPO receives the documentation pack: data flow, per-module classification and reasoning, sub-processor list, retention and deletion policy, and DPIA support material.

  2. Days 1 to 10

    Review, questions, and any client-specific amendments. We answer in writing, and the answers become part of the record.

  3. Before ingestion

    DPA executed and a named DPO contact recorded. The system refuses to create a data source without both. This is enforced in the onboarding flow, not by policy.

  4. Ongoing

    Any change to sub-processors, retention, or a module classification is notified to the recorded DPO contact before it takes effect.

05 · Sub-processors

The current list.

Sub-processors, their purpose, their location, and what personal data they process.
Sub-processorPurposeLocationPersonal data
VercelMarketing site hosting and edge deliveryEU (Frankfurt, fra1)None. The site sets no cookies and stores no visitor records.
Amazon Web ServicesPlatform compute, storage, and databaseEU (Paris, eu-west-3)Client data under the signed DPA, anonymised at ingestion.
Plausible AnalyticsCookieless site analyticsEU (Germany)No cookies, no cross-site tracking, no personal data retained.

Source: Humaniwork sub-processor register, versioned, 2026

06 · Security and retention

Controls, stated without adjectives.

TLS 1.3 in transit. AES-256 at rest, including backups and object storage.
Role-based access with least privilege. OIDC and SAML federation available for municipal identity providers. Administrative access is time-bound and logged.
Row-level isolation enforced in the data layer, with an automated cross-tenant access suite that runs on every build.
A separate, append-only audit log stream, retained independently of application logs.
Retention configured per data source. Deletion runs as an automated job with a verifiable log, and includes indexes and backups within the stated window.
Documented procedure with a 72-hour supervisory authority notification path under GDPR art. 33, and a named contact for every client DPO.
A vector index built from a dataset is a derivative of that dataset. Deleting source rows and leaving the index in place is not deletion. Our deletion job covers indexes and backups within the stated window and produces a verifiable log. This is where deletion usually fails in AI systems, so it is worth saying out loud.

07 · The six statements

What we say on every surface, said the same way.

  • Anonymisation at ingestion

    No individual-level data reaches the AI layer.

    No individual-level data enters the AI processing layer. Analysis runs on aggregated and pseudonymised data, and the rule is enforced at the pipeline boundary rather than by convention.

  • EU data residency

    EU infrastructure, Catalan residency for Catalan deployments.

    Infrastructure in EU jurisdiction, with Catalan data residency for Catalan deployments. The sub-processor list is published and versioned.

  • Per-module EU AI Act classification

    Classified per module, before deployment, because they differ.

    The classification is documented per module before deployment, because the modules are not equivalent. Employment-related matching is treated under the high-risk obligations. The civic analysis modules are advisory decision-support for institutions.

  • A human decides

    The platform ranks and explains. A person decides.

    The platform ranks, explains, and projects. A qualified human makes every hiring and every policy decision, and the decision is logged against their identity.

  • DPA before ingestion

    Signed, and your DPO briefed, before a record moves.

    A signed Data Processing Agreement and a briefed Data Protection Officer before a single record moves. The system refuses to create a data source without a recorded DPA reference.

  • Exportable audit trail

    Every output keeps what produced it, and exports.

    Every match, alert, and projection persists its inputs, model version, driving features, and confidence value. Exportable for labour inspection and public audit.

08 · Documentation pack

What your DPO receives.

  • Data flow diagram with the anonymisation boundary marked
  • Per-module EU AI Act classification, with the reasoning, versioned
  • Data Protection Impact Assessment support material
  • Sub-processor register
  • Retention and deletion policy, per data source
  • Security control summary and incident response procedure
  • Model cards, one per model per version
  • Indicator definitions and the academic review record

The pack is sent on request, before the first substantive meeting, without a qualification call. Write to dpo@humaniwork.com.

A downloadable version of the pack is being assembled and is not yet published here

09 · Accessibility

Conformance, stated honestly.

Public-sector buyers in Spain assess against EN 301 549. The full statement, including the known gaps, is a separate page rather than a paragraph here, because gaps stated in passing are gaps stated badly.

The accessibility statement

Corrections

If we publish a number that is wrong, we correct it in the same channel it appeared in, visibly, with the date of the correction. Corrections to published Signals appear on the piece itself.