Security and compliance

Who decides about the data

The client company is the controller of its workers' data: it decides what it loads and why. Pedro Jeremías Salvadeo processes it on the company's behalf, only to provide the service (processor).

Transita does not sell data, does not use it for advertising and does not use it to train artificial intelligence models.

Where the data is

Data is hosted on Railway servers in the United States (California), over encrypted connections. There is no region-specific hosting today: the region chosen at sign-up is recorded for when there is.

International transfers are governed by the data processing agreement, which includes standard contractual clauses when the client company's law requires them.

Security measures

Encrypted connections (HTTPS) across the service. Passwordless sign-in, with single-use links that expire after 15 minutes, or with Google or Microsoft.

Sessions and API keys are stored only as cryptographic hashes: anyone reading the database could not use them. API keys can be revoked at any time.

Role-based access (administrators, HR, area leads, people) and separation of each company's data. Every change is recorded in an audit log with who, when and what changed.

In the dashboard and reports, groups of fewer than 5 people are shown as “<5” so nobody can be identified.

Usage limits against abuse, automated tests before every deployment and error alerts.

The company can export all its data to a file and delete the company with all its data from “Settings”.

Responsible AI

Transita's AI suggests tasks and their exposure to automation per role, not per person. It does not evaluate, score or make decisions about workers.

Every suggestion is reviewed and validated by a person, and every transition plan is accepted by the person involved and signed by their lead and HR. No personal data is sent to the AI.

This design aims to keep Transita from working as an automated decision system about employment, in line with the EU AI Act, which treats such systems as high risk.

Reference frameworks

We use the EU General Data Protection Regulation (GDPR) and the EU AI Act as a reference; they also inspire new laws in several countries in the region, such as Chile's Law 21,719. We also take into account Argentina's Law 25,326 and Brazil's LGPD.

For development and management we follow ISO/IEC/IEEE 12207 (software life cycle), ISO/IEC 25010 (product quality), ISO/IEC 27001 (information security) and ISO/IEC 42001 (AI management) as guidance.

Transita does not currently hold certifications for these standards. If your company needs them to contract, let's discuss the scope.

If an incident happens

If we detect an incident affecting personal data, we notify the affected companies without undue delay and within 48 hours at the latest, with what we know and the measures taken, so they can meet their own obligations.

For privacy questions or to exercise your rights, write to hola@usetransita.app.

Providers that process data (subprocessors)

If we add or change a provider, we announce it in advance on this page and by email to client companies.