Security & Privacy

Trust Architecture, Data Protection & Organizational Compliance

Version 2.0 · October 2026

In Summary

ACHALAI is purpose-built to manage and interconnect highly sensitive organizational data: job architectures, workforce profiles, compensation structures, variable rewards, and strategic budget simulations.

Security, privacy, and strict tenant isolation are not afterthought add-ons; they are core architectural tenets embedded within our data models and operational workflows from day one.

This document outlines the technical, organizational, infrastructure, and governance safeguards implemented to ensure the confidentiality, integrity, and availability of your organizational assets.

1. Privacy by Design

Privacy and the responsible handling of personal data form the foundational cornerstone of ACHALAI (Privacy by Design and Privacy by Default). The platform enforces continuous controls guided by top international and regional benchmarks:

General Data Protection Regulation (GDPR - EU Regulation 2016/679): Core principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.
Personal Data Protection Act No. 25,326 (Argentine Republic): Formal registration and statutory safeguarding of databases, guaranteeing data subjects' rights of access, rectification, updating, and erasure.
B2B Processing Relationship: In delivering the software services, Customer acts as the Data Controller and ACHALAI acts as the Data Processor, formalized through an enforceable, binding Data Processing Agreement (DPA).

2. Infrastructure and Data Protection

The platform protects sensitive organizational data throughout every stage of its lifecycle using industry-standard cryptography and network hardening:

Data Encryption at Rest (AES-256): All persistent block storage volumes, relational databases, and automated backups are encrypted using the Advanced Encryption Standard (AES) with 256-bit keys.
Data Encryption in Transit (TLS 1.3 / HTTPS / HSTS): All communications between clients and ACHALAI servers travel encrypted via TLS 1.3 and TLS 1.2. The platform mandates HTTPS across all endpoints with extended HTTP Strict Transport Security (HSTS) and preload directives enabled.
Enterprise Cloud Infrastructure: Platform services are hosted in tier-1 cloud facilities featuring physical access controls, environmental redundancies, biometric entry barriers, volumetric DDoS protection, and high-availability clustering.

Note on Infrastructure Certifications: Physical facility and data center certifications (such as SOC 2 Type II and ISO/IEC 27001) are held by the underlying cloud infrastructure providers selected by ACHALAI for service deployment, and do not represent direct certifications issued to ACHALAI.

3. Identity and Access Control

Access to compensation records and organizational intelligence is defended through rigorous multi-layer access controls:

Least Privilege Access: Every user account is constrained to the minimal set of resources and views required to execute their specific job duties, delineated by role, organizational unit, and reporting lines.
Granular Role-Based Access Control (RBAC): Native system roles (ClienteAdministrador, CLevel, MiembroHR, Manager, and Ocupante) segregate visibility over base salaries, salary bands, contractor fees, and organizational changes.
Row Level Security (RLS): Data segregation is enforced at the database engine level, not merely in the frontend. Every query is filtered cryptographically using the authenticated user's session claims and tenant identifier, preventing cross-tenant data leakage.
Corporate Authentication and Single Sign-On (SSO): Native integration with Google Workspace via standard OAuth 2.0 and OpenID Connect protocols, alongside direct authentication for verified corporate email accounts. This allows organizations to enforce their own Multi-Factor Authentication (MFA) policies and benefit from their identity provider's account security controls.

4. Traceability and Auditability

To ensure operational accountability and compliance readiness, ACHALAI maintains comprehensive auditing and tracking mechanisms:

Immutable Audit Logs: Structured audit records capture every significant modification across the platform: compensation updates, salary grade revisions, occupant assignments, structural re-orgs, and permission grants.
Accurate UTC Timestamps: Each log entry includes an accurate timestamp, executing user ID, source IP address, action identifier, and previous vs. new values for forensic accountability.
Isolated Budgeting Sandbox: The compensation module provides an isolated, confidential modeling Sandbox. Leadership can evaluate budget increases and pay adjustments in a secure environment without affecting live payroll or disclosing unapproved decisions.

5. Privacy and Artificial Intelligence

ACHALAI builds artificial intelligence as an analytical decision-support copilot, never as an unmonitored black box. Our AI principles are non-negotiable:

Strict Zero-Training Policy: Customer data (salaries, org charts, occupant legajos, or personal identifiers) is NEVER used to train, retrain, or fine-tune ACHALAI proprietary AI models, nor third-party commercial models.
Isolated Models & Ephemeral Processing: AI analytical queries execute under enterprise agreements guaranteeing Zero Data Retention. Data is processed exclusively in-memory during inference and never logged or stored by model providers.
Human-in-the-Loop Governance: AI assists; humans decide. ACHALAI never executes automated employment or compensation decisions. Final discretion and authority remain exclusively with human leadership.
Accountability for AI Agents: When organizations model AI Agents in their organizational structure, the system mandates that each AI Agent be assigned to a designated human supervisor (employee or contractor) to preserve uninterrupted governance.
Objective Job Valuation: Our proprietary job valuation method evaluates the role and its objective scope, never the person occupying it, eliminating subjective or biased evaluations.

6. Data Retention and Control

Customer retains full ownership, dominion, and administrative control over all uploaded organizational data:

Native .xlsx Export & Interoperability: ACHALAI provides complete, native spreadsheet export (.xlsx) for all organizational, position, and compensation datasets, eliminating proprietary vendor lock-in.
Retention Lifecycle: Data is retained only for the active duration of the customer subscription. Upon contract conclusion, customers may request a comprehensive export of all data records.
Secure Deletion: Pursuant to DPA terms, upon termination or formal request, data undergoes logical purge and verified destruction across production and backup systems.
Binding Data Processing Agreement (DPA): ACHALAI provides an enforceable DPA stipulating technical measures, incident response procedures, breach notifications, and audit rights.

7. Infrastructure and Certifications Scope

To ensure uncompromised integrity without inflated claims, ACHALAI transparently details the precise scope of third-party certifications:

SOC 2 Type II: Tier-1 cloud hosting providers selected by ACHALAI undergo regular independent audits and hold verified SOC 2 Type II attestations based on AICPA Trust Services Criteria.
ISO/IEC 27001: The foundational infrastructure operates under certified Information Security Management Systems (ISMS) compliant with ISO/IEC 27001, supplemented by ISO/IEC 27017 (Cloud Security) and ISO/IEC 27018 (Cloud Privacy).
Transparent Scope: These certifications apply to the selected cloud infrastructure facilities hosting ACHALAI. ACHALAI does not claim direct certifications in its own corporate name where they have not been independently issued, preserving absolute veracity with clients and compliance officers.

For technical or security inquiries: info@achalai.com