You can check all of this yourself.
Admins find every part of it in hr goat, under one menu.
The audit log. Search it, filter it, and export what is shown.
The assistant cannot do anything you could not do yourself.
It is not one assistant with a set of keys. It is rebuilt out of the asking person’s own permissions, on every single request.
Built per person, per request
The tools the assistant has are assembled from that person’s own permissions, every time they ask. A manager and a payroll clerk are talking to two different assistants.
Reading and writing are separate
Reading needs permission for the area. Writing needs permission to write in it. Neither one implies the other.
Row by row, not just screen by screen
Being allowed on a screen is not the same as being allowed to see everybody on it. The row rules decide whose records come back.
Pay and warnings are their own keys
Compensation sits behind its own permission. So do formal warnings, and only people with the warnings permission can see warnings in the audit log.
A module you do not have is off, tools included
Switching a module off takes its screens and its AI tools with it, so the assistant cannot offer your workspace something it never bought.
Some fields it will never write
There is a list the assistant is not allowed to write to at all, pay among them, even when the person it is acting for could write there themselves.
Anything that reaches people waits for your yes.
Each of these needs a one-use confirmation that only a message from you can create, so the assistant cannot hand it to itself. A bulk import shows you the preview first, and the preview is logged.
- A message to your people
- Opening a survey
- Publishing or approving a policy
- Changing what hr goat’s own messages say
- Choosing who a checklist or learning trail reaches
- Sending a skills assessment, or adding people to one
We will not dress this up: every other single write happens straight away. What makes that safe is the permission model above and the fact that all of it is logged below.
Every AI write is on the record.
And a few things are kept off it on purpose. A log that copies a bank account into a second place has not made anybody safer.
What is recorded
The tool that ran, who asked for it, and what came back. Admins read it on the AI governance screen and download it as CSV.
What is deliberately not recorded
Sensitive values are written down as field=(set), never the value. Bank details, ID numbers, tax and UIF numbers, passports, special category data, and the text of a warning.
Escalations by category, never by quote
If somebody discloses something serious, the log records that it happened and under which category. It does not record what they said.
Who looked at what
Reads of salary, ID and bank details are logged separately and kept for 24 months. A workspace can set that longer, never shorter, and a legal hold holds it.
Every change, whatever made it
A second log keeps one row per change from any source, a person or the assistant, recording which fields changed.
How long the log is kept: it is part of your workspace, so it stays while your workspace does and goes when it goes. Deleted from live systems within 90 days of termination, and from backups within 35 days of that (Schedule 2, clause 15, and Privacy Policy, section 8). The model provider keeps nothing you send it beyond what it needs to return the answer and any disclosed security or abuse monitoring period (Schedule 2, clause 14.3).
Some things are not a question for a model.
Somebody will eventually tell an HR system something that is not an HR query. That path does not run through the model.
Checked before anything else
Wellbeing, safeguarding and grievance disclosures are caught by a check that runs before the routing model gets a turn. The router is itself a model, and it does not get to decide that a harassment disclosure is off topic.
The reply is written by code
Not generated. It points only at contacts your workspace has actually recorded, and it will not invent a hotline number.
It does not tell HR for you
Nothing is sent to anybody automatically. What happens next is the person’s own choice.
Uploads are treated as untrusted
Every uploaded document and fetched web page is wrapped in an untrusted-content envelope. A file that reads like a set of instructions is held back and you are told so: nothing in it has been used. The scanner is a filter. The envelope is the boundary.
Which model, where it runs, and what it is not used for.
Who runs it
Google Vertex AI, using current Gemini models.
Where it runs
Inference is not pinned to one region. Your records live in the EEA, the model call does not necessarily follow them there. We would rather tell you that than let you assume otherwise. Every route your data takes is named on the Sub-processor List.
Training
Your data is not used to train foundation models. That is Schedule 2, clause 14.2 of your agreement, not just a line on this page.
Who can read a conversation
The person who had it. An administrator cannot open somebody else’s chat.
What we count
Tokens per turn, so you can see where your credits went. The content of the turn is not kept alongside them.
The model does not mark its own homework.
When the assistant works through a setup task, the server goes and looks at the database before it agrees a step is done. Counting the rows. Checking the setting is actually set. Checking the field is actually filled. And if somebody asked for a change and nothing was written, the assistant gets another turn to do it properly instead of telling you it is finished.
The boring parts that actually matter.
Workspaces fail closed
Every table carries a workspace id, and a query that runs without a workspace throws an error rather than reading across to somebody else’s.
Anonymity is structural, not a promise
For pulse and upward feedback, who answered is stored apart from what was said, and results only appear once five people have replied.
Support can look, support cannot touch
When our team views your workspace as one of your people, the session is read only, enforced in three separate places, and audited.
Connected accounts
Tokens for your connected tools are encrypted, never stored without a key, and hard deleted when you disconnect.
Answers cite the clause
A policy answer tells you which clause it came from. If a rewrite changes a figure, the rewrite is thrown away rather than shown to you.
Not just a promise on a web page.
The same commitments are written into your agreement. Each one links to its clause.
No training on your data
Neither we nor our AI providers use your data to train, fine-tune or improve a model. Terms, clause 35.1
Only what the job needs
Only the personal data a request reasonably needs is sent to the model. Schedule 2, clause 14.1
The AI provider keeps nothing extra
Nothing beyond what it takes to return the answer, plus any disclosed security or abuse monitoring period. Schedule 2, clause 14.3
A person makes the big calls
AI output is advisory, and material employment decisions need a person to review them. Schedule 2, clause 14.4
It can be switched off
An admin can turn AI features off for the workspace, where that control is available. Schedule 2, clause 14.5
Then it is a fair one. Ask it.
Security questionnaires, penetration test summaries and audit reports go to the same place as everything else legal.
legal@hrgoat.ai