Built for enterprise review from the first conversation.
This page states what is in place today, what is coming and what is planned. Every control carries its status.
What is in place, and what is not yet.
| Control | What it means | Status |
|---|---|---|
| Tenant isolation | Each organization’s data is separated by the platform on every request; queries are scoped to the organization. | Available |
| Database-level isolation | Row-level security in the database is on the roadmap. | On the roadmap |
| Access control | Roles built from fine-grained permissions; every API route checks them. | Available |
| Least-privilege database access | Least-privilege database access is on the roadmap. | On the roadmap |
| Lifecycle history and records that can’t be edited | The database rejects changes to consent, identity and signing-event records; corrections are added as new entries. Signing events are linked in a hash chain. | Available |
| Encryption in transit, network and backups | TLS 1.2+ with HSTS. Databases are never exposed to the internet. Daily backups kept for 30 days. Hosted on AWS in the US (us-east-1). | Available |
| Encryption at rest and multi-factor sign-in | Encryption at rest and enforced multi-factor authentication are coming soon. | Coming soon |
| Single sign-on with Microsoft or Google | Sign in with a work account, set per organization. | Available |
| SAML SSO, SCIM, data residency outside the US | On the roadmap. | On the roadmap |
| Organization audit log | Org Admin includes an audit log alongside users, roles, sites and verified email domains. | Available |
| Talent privacy portal | Talent will see their records, consent and rights requests, and raise disputes. | Coming soon |
| Erasure | Erasure of a Talent’s data across the platform is coming soon. | Coming soon |
| AI data handling | AI features run on your organization’s own provider account, under that provider’s terms. Aramo does not train models on your data. | Available |
| SOC 2 Type II | An independent SOC 2 Type II audit is on the roadmap. | On the roadmap |
What we will not build.
These are product rules, not settings.
No LinkedIn scraping
Aramo does not scrape LinkedIn.
No automated submittals
A person submits. The platform does not send submittals on its own.
AI never decides about people
AI drafts and extracts. It never orders, filters or decides about people.
Copilots draft. Agents will act only within the scopes you configure.
Drafts a person reviews
Available for drafting and extraction: requisitions, first-contact messages and résumé intake. A recruiter accepts, edits or discards; nothing is saved or sent without a person. For some features, personal data is removed from prompts where it is not needed. Search assistance Coming soon
Agents inside your scopes
Agents will run inside action scopes, approval thresholds and data boundaries set per organization, with a full run log.
AI Agents & Solutions →Send us your security questionnaire.
We answer from the controls register above, and tell you plainly what is planned.