Standards & Trust Center
Last updated: November 13, 2026
Cherii is an AI-supported HR platform built on a human-in-the-loop approach. AI helps teams source, screen, interview and manage people faster — but it never makes decisions on its own. This page summarises the standards, controls and governance principles the platform is designed around.
Compliance
The platform is designed in alignment with the following frameworks:
- UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)
- EU General Data Protection Regulation (GDPR)
- EU AI Act — governance readiness for high-risk AI systems used in employment
Alignment describes how the platform is designed and operated. It is not a claim of third-party certification.
Resources
The following documents can be shared with customers and prospective customers under a service agreement or NDA:
EU AI Act Compliance & Risk Management StatementOn request
AI System Technical DocumentationOn request
Fundamental Rights Impact Assessment (FRIA)On request
Data Processing Agreement (DPA) with Standard Contractual ClausesOn request
Transfer Impact AssessmentOn request
Subprocessor RegisterOn request
Data Subject Rights PolicyOn request
Data Retention & Disposal PolicyOn request
Controls
Access control
- Role-based access control (RBAC) per tenant
- Multi-factor authentication support
- Least-privilege access for staff and systems
- Automatic session timeout
Data security
- Encryption at rest (AES-256)
- Encryption in transit (TLS 1.2+)
- Data Protection Impact Assessments
- Standard Contractual Clauses for transfers
- Secure data disposal
Application security
- Separated development and production environments
- Code review before release
- Dependency vulnerability scanning
Infrastructure
- Network firewalling
- Centralised logging and monitoring
- Backups and disaster recovery
Incident response
- Documented incident response plan
- Notification of personal data breaches within 72 hours where required
Compliance & auditing
- Internal security assessments
- Record of Processing Activities (RoPA)
- Annual policy review
Privacy & data governance
- Explicit opt-in consent from candidates
- Service intended for users aged 18+
- Data minimisation and privacy by design
- Deletion on request or at end of retention
Employee security
- Security and privacy awareness training
- Confidentiality agreements
AI governance
Rii, the AI agent inside Cherii, operates under ten governing principles:
- 1Decision support only — Rii recommends; people decide. No autonomous hiring or employment decisions.
- 2No biometric analysis — interview assessment is based on transcripts, not facial expressions, voice tone or appearance.
- 3No model training on customer data — your candidate and employee data is not used to train AI models.
- 4Protected characteristics excluded — age, gender, nationality, religion and similar attributes are not used for scoring.
- 5Transparency and explainability — every score is accompanied by its reasoning (aligned with EU AI Act Art. 13).
- 6Human oversight — reviewers can override, adjust or disregard any AI output (Art. 14).
- 7Risk management — AI risks are identified, assessed and mitigated throughout the lifecycle (Art. 9).
- 8Statistical monitoring — outcomes are monitored for drift and adverse impact.
- 9Post-market monitoring — performance and incidents are tracked after release (Art. 61).
- 10Technical documentation — system design and data flows are documented (Annex IV).
Subprocessors
A current list of subprocessors, including their location and purpose, is provided on request through your organisation’s HR administrator or under your service agreement.