Trust Center
Built for the trust that personal data deserves.
Settio handles personal and immigration data for international hires. That comes with serious responsibility. This page gathers everything procurement, legal, IT, and security teams need to evaluate us, GDPR, security, AI use, subprocessors, and more.
HTTPS
Encryption in transit
Never
Identity documents to AI
48 h
Breach notice to customers
Never
Data sold
How we earn trust
Six commitments we hold ourselves to.
GDPR by design
Built on EU data protection principles: lawful basis, minimization, purpose limitation, transparency, and full data subject rights.
Transfers with safeguards
Where a provider is outside the EU or EEA, transfers rely on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Locations are on the subprocessors page.
Encryption everywhere
HTTPS for every connection, encryption at rest by our providers, and identity numbers encrypted again in our code.
Responsible AI
Customer data isn't used to train AI models. Passports and ID cards never go to AI. Every AI result is a suggestion a person checks.
Least-privilege access
Each workspace sees only its own data, roles decide what each user may do, and opening identity details is logged.
Customer-controlled data
Export, correct, or delete data at any time. We give you full ownership over what your team and your hires put in.
Documents & policies
Everything you need for procurement.
Public versions of our agreements and policies. Need a countersigned DPA or answers to your security questionnaire? Email [email protected].
Privacy Policy
How we collect, use, share, and protect personal data, written for the GDPR.
Terms of Service
The contract that governs your use of Settio's products and services.
Data Processing Agreement
Article 28 GDPR DPA covering Settio's role as your processor, and how transfers are protected.
Security Overview
Our application, infrastructure, organizational, and incident response controls.
AI & Responsible Use
How Settio uses AI, what we don't do with your data, and how to keep humans in control.
Cookie Policy
Cookies and similar technologies we use, and how to control them.
Subprocessors
Vendors that may process customer personal data on our behalf, and where they operate.
Where your data lives
Customer personal data is stored and processed in the EU/EEA (primary region: Stockholm, Sweden). Backups remain in the EU. Any transfer outside the EEA, where unavoidable, is governed by Standard Contractual Clauses (SCCs) plus supplementary technical measures.
Reporting & contact
Privacy: [email protected]
Security: [email protected]
Vulnerability disclosures are welcome at the same address.
Our promise
We don’t sell personal data. We don’t mine your hires’ data for advertising. We don’t train third-party AI models on your content. You stay in control : always.