// Trust & Security Report
Avature Limited and Avature LLC
AI-powered recruitment and talent management platform serving enterprise customers; includes enterprise recruiting suite, higher education recruiting, internal mobility, HR case management, and public sector solutions.
Certifications held
10
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on avature.ai“SOC 2 certified since 2016, audited annually. Scope covers security, availability, processing integrity, confidentiality and privacy.”
Verify on avature.ai“ISO 27001 achieved 2017, independently audited annually, recertified triennially. This globally recognized, standards-based approach to security outlines Avature's information security management system (ISMS).”
Verify on avature.ai“ISO 27017 certification achieved 2021, covering cloud security practices.”
Verify on avature.ai“SOC 1 certified since 2013, audited annually, covers technical and financial controls that could potentially impact the financial statements of customers.”
Verify on avature.ai“EU Binding Corporate Rules (BCRs) approval for both Processors and Controllers; participant in EU-U.S., UK extension, and Swiss-U.S. Data Privacy Frameworks.”
Verify on avature.ai“Self-certified compliance with Payment Card Industry (PCI) Data Security Standard (DSS) requirement; uses PCI Security Standards Council (SSC) Approved Vulnerability Scanning (AVS) Vendors.”
> Show 2 unconfirmed / not-held certifications
source: avature.aiNo public evidence of ISO 27018 certification on vendor trust center or documentation reviewed.
source: avature.aiNo public evidence of ISO 27701 certification on vendor trust center or documentation reviewed.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
Multi-region: USA, Netherlands, Germany, Australia, Japan, China, Singapore (customer-configurable per agreement)
Privacy policy explicitly states Avature does not collect personal data for resale, sell personal data, or sell access to personal data. Avature acts as a data processor with customers as controllers. AI features are platform-native but no public evidence of training on customer data.
// Security controls
Penetration testing
Biannual penetration tests for application, mobile app, and network performed by PCI-certified third party
avature.aiData center security
High-security ISO/SOC-certified facilities with perimeter fencing, 24/7 security personnel, multi-zone access control
avature.ai// Products & data scope
data: Candidate and employee data
Core offering for large enterprises; award-winning solution
data: Faculty and staff hiring data
Specialized for institutional hiring needs
data: Employee career and internal opportunity data
Talent marketplace for internal opportunities
data: HR issue resolution and employee data
Designed with HR leaders for workforce issue resolution
data: Government hiring data
Trusted by US federal, state, local governments and international public sector
// What to watch
- SOC 2 Type I vs Type II not explicitly stated in public documentation (annual auditing suggests Type II, but should be verified)
- ISO 27018 (cloud PII) and ISO 27701 (privacy information management) not mentioned despite handling substantial personal data; these would strengthen their posture for privacy-critical customers
- AI training posture on customer data not explicitly documented; while privacy policy denies data reuse, a dedicated statement on AI model training would be clearer
- FedRAMP authorization is recent (April 2025) and should be monitored for audit findings
// At a glance
Pricing model
Enterprise SaaS (subscription-based; customer-configurable deployment)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Avature Limited and Avature LLC's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
avature.ai