Security and compliance architecture overview

1. Governance and security management

Zeenna has a defined information security management system with clear roles and responsibilities, risk management, recurring controls, management review and continual improvement. Identified security risks are assessed, assigned to accountable owners and tracked until they are remediated or formally accepted.

2. Data protection and privacy

Personal data processing is governed by internal data protection rules and GDPR principles. Zeenna applies lawfulness, transparency, data minimisation, purpose limitation, accuracy, storage limitation and appropriate security of personal data.

3. Access management

Access to systems and data is governed by need-to-know, least privilege and separation of duties. Critical systems use role-based and approved access, recurring permission reviews, MFA and, where appropriate, SSO. Production access and administrative activity are logged and monitored.

4. AI governance and human oversight

Zeenna separates language-model functions from evaluation logic. AI supports conversation, question generation and response summaries, while candidate evaluation uses recruiter-defined rules and weights. An authorised human always makes the final decision. The process supports traceability of inputs, criteria, scores and human interventions.

5. Candidate transparency

Candidates are informed before screening begins that they will interact with an AI system. Zeenna supports the initial stage of recruitment and is not designed to make autonomous hiring or rejection decisions.

6. Secure operations and change management

The operating environment includes access controls, security-event monitoring, backups, vulnerability management and controlled change processes. Material system and configuration changes follow approval and change-management procedures.

7. Business continuity and disaster recovery

Zeenna maintains a framework for service continuity and recovery during disruptive events. It covers backups, recovery procedures, monitoring, relevant failover measures and recurring readiness testing.

8. Audit trail and evidence

Security and AI governance processes are documented through ISMS and AIMS materials, internal policies, audit records, risk registers and operational evidence. Supporting evidence is made available according to the due-diligence scope, contractual terms and document sensitivity.

9. Detailed customer documentation

• Zeenna AI system instructions for use
• Decision process architecture and AI explainability guide
• Data protection and security policies
• Access-control documentation
• Risk-management documentation
• Business continuity and disaster-recovery documentation
• Subprocessor and processing-location information
• Available audit and security evidence

10. Compliance framework

Zeenna operates its security and AI governance programme with regard to applicable regulatory, contractual and security requirements. Certifications, audit reports and regulatory statements are communicated only to the extent that they are current, complete and supportable by evidence.