Security
Review every data path before the pilot.
Security is not a label. A review connects each data type to a store, connection, sub-processor, access right, retention period, and piece of evidence. This is the scope to examine with Lontra.
Service region
The application service deployment configuration targets Google Cloud europe-west1. That does not by itself confirm the region of a running instance or the regions used by models and other sub-processors.
Models and sub-processors
The review records each provider that receives data, its purpose, the categories transferred, processing region, retention, and transfer mechanism.
Encryption by path
Review encryption evidence separately for browser, service, database, object storage, backups, and external providers.
Organization isolation
The application uses a shared database with logical organization isolation. Representative routes and administrator exceptions belong in the security test.
Roles and views
Before invitations, test the accounts that can access campaigns, summaries, exports, and conversations. The plan must keep raw conversations out of manager views and apply a minimum of five respondents to collective HR analysis.
Recorded audio
In the recorded-interview flow, a recording is encrypted before storage and deleted after transcription. The transcript and derived content have their own retention lifecycle.
Sensitive information
The reflective path applies pre-storage redaction for certain categories and languages. The control is not exhaustive and does not replace minimisation, output review, or a process for unexpected content.
Retention and deletion
The schedule should cover every data type and derivative, including logs and backups. The procedure names its trigger, owner, timeline, verification, and end-of-contract return.
Human decisions
Models prepare material for review. They do not make a decision affecting an employee on their own.
Certification status
No ISO 27001 certification or SOC 2 report is claimed. The launch decision relies on controls and documents examined for the agreed scope.
Evidence to examine during review
Ask for a dated version scoped to the relevant service. A general policy does not replace evidence for the actual data flow.
01
Data-flow diagram and data inventory
02
Infrastructure configuration and encryption evidence
03
Sub-processor and transfer register
04
Role, view, and exception matrix
05
Retention schedule and deletion test
06
Individual-rights procedure
07
Incident plan and escalation contacts
08
Participant notice and DPIA inputs
FAQ
Which region does the service configuration target?
The application service deployment configuration targets Google Cloud europe-west1. The effective region and model, voice, authentication, email, and observability processing must be confirmed separately; the whole service is not described as EU-only processing.
Is data encrypted?
The infrastructure path documents encryption for the main connections and stores, and the documented audio path encrypts the recording before storage. The review should confirm every flow and copy without turning partial evidence into a universal guarantee.
Is Lontra ISO 27001 or SOC 2 certified?
No ISO 27001 certification or SOC 2 report is claimed. Ask for the current status and examine evidence for the controls that apply to the pilot.
Which sub-processors are involved?
The list depends on the enabled paths. It should name the relevant model, voice, authentication, storage, email, and observability providers, with purpose, region, retention, and transfer terms.
How is deletion verified?
The deletion plan should trace data through transcript, summary, memory, signals, exports, logs, and backups. The customer and Lontra agree the owner, timeline, and completion evidence.
Does filtering prevent all sensitive data from entering?
No. Pre-storage redaction exists on the reflective path for certain categories and languages, but it is not exhaustive. The pilot should limit what is requested, inform participants, test unexpected cases, and provide human review.
Can AI output decide for an employee?
No. Output prepares review by an accountable person. It does not trigger an employment decision on its own.
Rolling out across countries, or want to look at your case together? Book a thirty-minute conversation.
30 minutes. Your problem, your teams, your measure.
Less theater. More humans.