Trust centre
Your data, under controls you can see.
Seven20 is ISO 27001 certified and built to meet GDPR obligations. The platform runs inside Salesforce, on Amazon Web Services infrastructure, so the foundations underneath your recruitment data are the same ones used by some of the largest regulated businesses in the world.
Independently certified.
CERTIFICATIONS
Seven20 is ISO/IEC 27001:2022certified and built to meet GDPR obligations. The platform runs inside Salesforce, on Amazon Web Services infrastructure, so the foundations underneath your recruitment data are the same ones used by some of the largest regulated businesses in the world.
Where your data lives
Three layers, and only one of them is ours.
Most recruitment tools are one company's application on rented infrastructure, which means the security of the layer holding your data is that company's own to build and prove. Seven20 works differently.
Your candidate, client, and placement records sit in your own Salesforce org, governed by Salesforce's security model and certifications. Amazon Web Services sits underneath. Our own responsibility is our software, our people, and our processes, which is what our ISO 27001 certification covers.
our layer
Seven20
Software, people, processes
Certified to ISO 27001 by Insight Assurance, covering our information security management system: access control, change management, incident response, supplier management, and regular independent audit.
platform
Salesforce
Your org, your records
Maintains ISO 27001, ISO 27017, ISO 27018, ISO 42001, SOC 2, PCI DSS, and more, published in full at compliance.salesforce.com.
Infrastructure
AWS
Region of your choice
Maintains ISO 27001, SOC 1, SOC 2, SOC 3, PCI DSS Level 1, UK Cyber Essentials Plus, and more, published at aws.amazon.com/compliance/programs.
Enterprise controls, without an enterprise project.
What that gives you
Access you control.
Permissions, sharing rules, and field-level security are administered by your own admins using standard Salesforce tools. You decide who sees what, and you can change it without raising a request with us.
Encryption as standard.
Data is encrypted in transit and at rest, with optional platform encryption for your most sensitive fields.
An audit trail on everything.
Field history, login history, and audit trails apply to Seven20 records the same way they apply to everything else in your org. Six months later you can see what changed and who changed it.
GDPR built into the workflow.
Validation rules, retention handling, data subject requests, and document management sit in the platform rather than in a separate compliance tool. Our data processing agreement covers the whole platform.
AI with quality guardrails, not just security ones.
A confident wrong answer is a data problem before it's a security one. Nothing our AI captures writes to a record until a recruiter approves it, and admins scope what it can touch by team and by field.
Your data stays yours.
It's held in your Salesforce org and you can export it at any time. No lock-in.
One platform means one security review.
Fewer vendors, less to review
A stack of tools is a stack of contracts, a stack of data processing agreements, a stack of third-party risks, and a stack of integrations that can break or leak.
Running front, mid, and back office on one platform reduces complexity. It's a smaller attack surface and a shorter supplier review, and it's usually the argument that lands with an IT director faster than any feature.
Frequently asked questions
Both, and they cover different things. Seven20 holds its own ISO 27001 certification covering how we run our business and build our software. Salesforce and Amazon Web Services hold their own certifications covering the infrastructure underneath. We can point you to theirs and give you ours.
In your own Salesforce org, in the region you choose. Some features store additional files, such as call recordings and transcripts from Notetaker, in Seven20-managed storage on Amazon Web Services in your chosen region. Both are covered by your Seven20 contract and data processing agreement, so there's no second vendor and no second agreement.
Access is on a least-privilege basis and limited to support and delivery work on your behalf. Your own admins control what our team can reach, using standard Salesforce permissions.
Not for standard encryption, which applies by default. Shield adds platform encryption for specific fields and event monitoring, and it's a separate Salesforce licence. We'll tell you honestly whether your requirements need it.
No. Seven20 does not use customer data to train its AI features. Our AI features are designed to process data within the relevant security and trust frameworks, and we do not use customer data to train AI models.
Not currently. We hold ISO 27001, which covers substantially the same control areas and is the recognised standard across the UK and Europe. If SOC 2 is a hard requirement for your review, tell us early and we'll be straight with you about where we are.