HiBob and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. HiBob states customer data processed by its AI features is not used to train AI models, and its AI service providers may not train their models on it.

Vendor's wording: “Customer Data processed by HiBob AI Features is not used to train artificial intelligence models.”

Source: hibob.com2. Data Usage and PrivacyChecked on 19 October 2026

EU: Amazon Web Services data centres in Ireland (main) with Germany (backup).

Vendor's wording: “HiBob uses AWS data centers in Ireland (main) and Germany (backup).”

Source: hibob.comWhat is HiBob doing to meet security standards? Data Hosting LocationChecked on 19 October 2026

EU hosting not documented.

Hosting is in the EU by default (AWS Ireland and Germany), and the sub-processor list shows EU processing locations; no separate EU setting or non-EU region choice is described.

Vendor's wording: “HiBob uses AWS data centers in Ireland (main) and Germany (backup).”

Source: hibob.comData Hosting LocationChecked on 19 October 2026

DPA on request.

Yes. A Data Processing Addendum is an integral part of the Subscription Terms, pre-signed by HiBob and available for counter-signature by the customer.

Vendor's wording: “This Data Protection Addendum has been pre-signed by an authorized signatory on behalf of HiBob and is available for execution by counter-signature”

Source: hibob.comData Processing AddendumChecked on 19 October 2026

Published.

Yes, public at https://www.hibob.com/privacy/hibob-subsidiaries-and-sub-processors/ (Nov 2025): 8 group affiliates and 23 third-party rows (19 companies) across core, optional and module-specific lists. AI providers named: OpenAI, Microsoft (Azure OpenAI), Amazon Web Services (hosted AI models).

Vendor's wording: “The following tables provide information regarding HiBob’s corporate affiliates and third-party Sub-processors that may have access to Personal Data”

Source: hibob.comHiBob Subsidiaries and Sub-ProcessorsChecked on 19 October 2026

On the list.

Active (Hibob; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Hi Bob'Checked on 19 October 2026

Customer data sent to AI providers is not stored or logged. After the contract ends HiBob deletes personal data of authorised users within 30 days, and the customer can request a copy within 14 days of termination. In-term retention periods not stated.

Vendor's wording: “HiBob shall in accordance with its DPA, delete Personal Data held about any Authorized User within thirty (30) days from the date of termination.”

Source: hibob.com12.4 Effects of TerminationChecked on 19 October 2026

ISO 27001, ISO 27018, ISO 42001, SOC 1 Type 2 and SOC 2 Type 2 (5 named); HIPAA and GDPR compliance also listed.

Vendor's wording: “HiBob follows industry best practices, including ISO 27001, ISO27018, ISO42001, HIPAA, GDPR, SOC2 type 2, and SOC1 type 2”

Source: hibob.comEncryption at every stepChecked on 19 October 2026

Yes. Admins can selectively disable or enable AI features through the AI Settings page and restrict access to specific features by role.

Vendor's wording: “Admins can selectively disable or enable features through the AI Settings page.”

Source: hibob.comOpt-out control for AI featuresChecked on 19 October 2026