Ceipal AI

No formal post-market monitoring or AI-specific incident reporting mechanism described in the security, privacy, or GDPR compliance pages. Security measures include: annual third-party SOC 2 Type II audits covering governance, change management, access control, data redundancy/backup, and software development; ISO 27001 certification; regular third-party penetration testing (4x annually); bug bounty program; WAF; static code analysis; background checks for all employees; encryption at rest and in transit (SSL/TLS); multi-factor authentication; N+1 infrastructure redundancy with 99.95% uptime SLA. Breach notification: Ceipal will notify customers without undue delay after becoming aware of a Personal Data Breach.

AI-Powered People Analytics performs personality assessments and 'cultural fit' scoring -- a use case with known bias and fairness considerations in employment contexts (EU AI Act high-risk category: employment). No independent validation, accuracy metrics, or bias audit results published for the AI matching or personality assessment features. No EU AI Act risk classification stated. Privacy Shield framework referenced but no longer valid post-Schrems II (July 2020); Ceipal states it does not rely on Privacy Shield as a legal basis and uses SCCs instead. Data transfers to US and India may raise adequacy concerns for EU customers. No DPO explicitly named (compliance@ceipal.com is the privacy contact). Employee count not publicly disclosed.