Your HR Data. Stored in Germany. GDPR by Design.
octo.taxi stores all HR data in AWS Frankfurt (eu-central-1): the database, its backups and the sync engine. The application runs on Cloudflare's global network, and AI features are processed only within AWS regions in the European Union. GDPR compliance, works council readiness and security are built into the architecture, not bolted on after.
For IT architects: not another middleware
Your IT landscape is heavy enough. We think in milliseconds. We believe in first principles and as few moving parts as possible: octo.taxi is not a bloated middleware but purpose-built for one job – bringing data from HR platforms like Cornerstone OnDemand and its Workforce AI to the dashboards, BI tools and employee apps your people use. Octily runs it as a service, so your IT does not build, host or patch anything.
What your IT sets up
For Cornerstone: one read-only API app. For every other platform: the read access its connector needs. For an employee app or intranet: one connection on its side. Nothing to install, host or patch.
What Octily runs
The sync, the access rules, monitoring and the follow-up on every release of the platforms you connect – for Cornerstone, backed by over 10 years as a Certified Cornerstone Partner.
One source of truth
Your HR platforms stay your systems of record. octo.taxi reads them through their documented APIs – Cornerstone near-realtime – and every view shows how old its data is.
Gentle on your HR platforms' API limits
octo.taxi reads each change from the source once, instead of asking it on every page view – so your HR platforms' API limits stay free for everything else.
Built to scale
Built for organizations from 1,000 to half a million employees and more – shaped by a decade of work with 105+ large international organizations and their exact needs and pain points.
Open in both directions
Cornerstone is where we started. Every other system joins as its own connector, built for you on demand, and everything that reads from octo.taxi stays as it is. Leaving is free: a full export in open, documented formats, no exit fee.
Privacy Architecture
Customer data isolation
Each customer's data – and each of its environments – is kept in its own protected area of the database. Every request is checked against the organization it comes from, verified by automated tests with every release.
Privacy rules on every data access
Every data access runs through one privacy layer. It applies entity scoping, records an audit entry and, in dashboards and the data explorer, applies field masking and minimum group sizes wherever you switch them on.
Encryption at rest
All stored data is encrypted with AES-256. Credentials for your connected systems are additionally encrypted with AES-256-GCM, with the key held outside the database.
Role-based access control
Five roles from owner to viewer, plus entity scoping for analysts, auditors and viewers, so people see only the data their role requires.
Works Council Ready
Designed with the requirements of German works councils (Betriebsrat) and European employee representation bodies in mind.
Aggregates for questions
Ask Auto Mate answers only with aggregates over groups of at least five people – or the larger minimum your organization sets. Individual records, for example in the data explorer, follow your individual data policy, and each access to them is recorded in the audit log, which is on by default.
k-Anonymity thresholds
Configurable minimum group sizes suppress results that are too small to protect individuals; on by default with a floor of five. A rate of 0 % or 100 % over fewer people is never shown, nor a figure that could be worked out by subtracting visible groups from a total. Managers are compared without names. Ask Auto Mate always hides groups of fewer than five people.
Individual data policy
One policy decides on every path who may open a single person's record: aggregates only (works council mode), individuals for analysts and above, or for every member; managers can be limited to their own reporting line. Pay, performance, recruiting and termination data need an explicit grant per role, and nobody has it by default. An entity, a role or a person can only be restricted further, never widened.
Query guardrails
Before a question reaches the AI, a guardrail rejects questions that target an individual's behavior or performance. You can tighten it to an allowlist of recognized questions.
No performance monitoring
octo.taxi has no feature built to monitor or score individual employees: no rankings of people, no behavior tracking, no automated decisions about people. This is a deliberate product decision.
GDPR Compliance
Purpose limitation
You decide which data is synced and what octo.taxi does with it. Your selection and configuration are your documented instructions under our data processing agreement.
Data minimization
You choose which data objects are synced; objects you switch off are never collected. Selected objects are mirrored in full, exactly as in your source system.
Field masking
Fields you mark as sensitive are masked for your whole tenant: they are removed from results in dashboards and the data explorer and cannot be used to filter or group.
Data subject rights
Changes and deletions in your source system reach octo.taxi with the next sync. For access, rectification, erasure and portability requests (GDPR Articles 15 to 20) we support you as agreed in our data processing agreement.
Retention policies
History & Trends is an add-on Octily sets per tenant: earlier versions of records and records deleted in the source are kept for 30 days by default, figures over time without names for three years. Logs have fixed periods (audit log one year). Every night whatever has expired is removed and each run is logged; the current state of your data is never deleted.
Legal basis documentation
As the controller, you set the legal basis for processing your employees' data; our data processing agreement documents what we process for you. Consent to the AI features is stored per user and tenant with a timestamp and the version of the consent text; a person can withdraw it at any time on their account page, and a new text version asks for consent again.
Access Control
Entity scoping
Data access can be restricted to specific organizational units, locations, or custom entity hierarchies.
Role-based access
Five predefined roles (owner, admin, analyst, auditor, viewer) control which data, dashboards and settings each user can access.
Manager hierarchy
Dashboards can be filtered to a manager's reporting line, direct and indirect reports included. Who may see what is set by role and entity scope.
Audit logging
Data access and administrative changes are logged with user, time and context. Every individual-level access records whose record was viewed, by whom and via which path; your admins review the log and export the individual-level access report in octo.taxi.
Two-factor sign-in
Sign-in with a code from an authenticator app (TOTP) plus one-time backup codes, stored only as hashes. Mandatory for Octily's super admins; your organization can make it mandatory for every member.
Invitation-only accounts
There is no public sign-up: accounts exist only by invitation from your organization's admins, and every new member starts with the role they were given.
Infrastructure & Network Security
Your data rests in AWS Frankfurt and reaches your browser through Cloudflare's global network, with protection at every layer from the edge to the database.
AWS Frankfurt (eu-central-1)
The database, automated backups and the data sync run in AWS eu-central-1 (Frankfurt, Germany). Data at rest is encrypted by AWS with AES-256. Your HR data is stored only in Frankfurt; outside it, it is processed only in transit and in short-lived caches.
Secure sessions
The application and its API share one domain, and sessions use secure cookies that scripts on the page cannot read. Two-factor sign-in with an authenticator app is available to every account, required for Octily's super admins, and can be required for your whole organization.
Managed firewall rules and rate limits
Every request passes through Cloudflare's edge before it reaches the application: Cloudflare's managed firewall ruleset blocks high-impact, widely exploited attack patterns, DDoS protection is always on, and sign-in, password reset and AI requests are rate-limited per client.
Encrypted at rest
All stored data is encrypted with AES-256. Credentials for your connected systems are additionally encrypted with AES-256-GCM, with the key held outside the database.
DDoS Protection
Cloudflare provides always-on, automatic DDoS mitigation at the network edge – protecting availability without manual intervention.
TLS 1.2 or newer, HSTS everywhere
All connections use TLS 1.2 or 1.3; TLS 1.0 and 1.1 are refused at the edge, and TLS 1.3 is used wherever your browser supports it. Plain HTTP is redirected to HTTPS, HSTS is enforced on every octo.taxi host for one year including subdomains, and the database accepts encrypted connections only.
Sub-Processors
| Name | Purpose | Jurisdiction | DPA | SCC |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, data processing and AI inference (Amazon Bedrock, Claude models) – Frankfurt, Germany; AI within EU regions | EU | Active | Not required |
| Cloudflare Inc. | Application delivery, edge protection, rate limiting and short-lived caches – global network, users in Europe normally served from European data centers | US | Active | Active |
| Plus Five Five, Inc. (Resend) | Transactional email delivery | US | Active | Active |
| Slack Technologies, LLC (Salesforce) | Internal operations alerts (platform account data only) | US | Active | Active |
Public reference data
Some quick answers in the search need public reference data. The octo.taxi server fetches it from fixed addresses and caches it - without your query, your data or anything that identifies you. These providers therefore receive nothing from you or your organization and are not sub-processors.
| Source | Used for | Data from you |
|---|---|---|
| European Central Bank (ECB) | Euro reference exchange rates for currency answers, once a day | None |
| Nager.Date | Public holidays for working-day answers | None |
| Coinbase | Crypto and currency spot rates for crypto answers, at most once a minute | None |
Data Residency
EU-hosted infrastructure
Database, automated backups, and the data sync engine all run in AWS eu-central-1 - Frankfurt, Germany. Backups stay in the same region.
Application delivery
The application runs on Cloudflare's global network and connects securely to the database in Frankfurt. Cloudflare serves each request from a data center near the user, for users in Europe normally a European one, and may keep short-lived caches there. Your HR data itself is stored only in AWS Frankfurt.
International transfer safeguards
HR data is stored in the EU. AI queries are processed by Amazon Web Services via Amazon Bedrock, called from Frankfurt (eu-central-1) and processed only within AWS regions in the European Union. Where providers are based in the US (Cloudflare for delivery, Resend for e-mail), transfers rely on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses; e-mails carry names, addresses and links, not HR records.
Transparency on automated processing
Here is exactly how plain-English questions and the dashboard builder work behind the scenes – which processors handle what data, what stays in the EU, and your control over the flow.
How it works
You type a question, or use the AI dashboard builder. The AI receives your text word for word and a description of your data: metric, table and column names and, for Ask Auto Mate and the dashboard builder, the names of your countries, locations, departments and divisions (Ask Auto Mate also grades and mandatory courses, the builder also the org-unit fields to compare by). It returns a plan or a read-only query; octo.taxi checks it and computes the answer on your own database in Frankfurt. Your employees' records are never sent to the AI.
Amazon Bedrock (EU) as processor
Amazon Web Services EMEA SARL acts as our data processor under a DPA. Queries are processed via Amazon Bedrock, called from Frankfurt (eu-central-1) and processed only within AWS regions in the European Union, using Anthropic's Claude models served entirely by AWS, with no independent data use by the model provider.
User consent
Each user is asked for consent before their first AI question. The consent is stored with a timestamp and the version of the consent text (GDPR Art. 7), the server refuses AI requests without an active consent, and each person can withdraw it at any time on their account page. Admins can switch the AI features off for the whole tenant.
No training data use
Your data is never used to train language models. Model-invocation logging is switched off, Amazon Bedrock does not store prompts or completions for the models we use, and Anthropic (the model provider) has no access to your data.
Security pack on request
Our data processing agreement, technical and organizational measures and sub-processor list, as PDF documents for your security and procurement review. Ask us and we send them to you.
Certifications, honestly
Octily itself is not ISO 27001 certified. AWS and Cloudflare, the infrastructure octo.taxi runs on, hold ISO 27001 certifications and SOC 2 reports.