SOC 2 Type I
Security controls designed and documented. Target audit date: April 2027.
Trust Center
We protect your people's information as if it were our own
Givel HR Services and Givel Payroll Services process payroll, recruitment and NOM-035 data for Mexican and international companies. This page shows, plainly, which controls are already running, what we are preparing and who we trust with your data.
Updated November 5, 2026 · info@grupogivel.com
Compliance status
We would rather tell you exactly where we stand: we do not hold certifications yet. We are implementing the controls these frameworks require and collecting the evidence to have them audited.
SOC 2 Type II
Six-month observation period after Type I. Target: October 2027.
ISO/IEC 27001:2022
Information security management system. Target certification: 2028.
NIST CSF 2.0
Internal reference framework to measure and organize our controls.
Mexican data protection law
Privacy program under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (2025).
NOM-035-STPS-2018
Questionnaire platform with results that never show names, and an anonymous reporting channel.
Controls in operation
Every control is documented in our internal policies and backed by evidence. We only list what is already running.
Infrastructure
- System code and configuration kept outside the server's public folder
- Encryption in transit with HTTPS on every site and the system
- Browser security headers (protection against framing and content-type spoofing)
- Daily monitoring of availability, errors and certificate expiry
- Daily encrypted (AES-256) database backup stored off the server
- Backup restore test every 3 months (most recent: November 2026)
Organization
- Information security officer and deputy appointed
- Documented security policies (pending approval): access, data, change management, backups, continuity, incidents, vendors, vulnerabilities, people and privacy
- Annual risk assessment with treatment plans and dates
- Two-step verification on administrative accounts
- Documented emergency access procedure
Product
- Client portal accounts only by invitation or accepted proposal
- Authenticator app (Google or Microsoft Authenticator) for clients, with backup codes
- Role- and division-based permissions; each person sees only what they need
- Cross-site request forgery (CSRF) protection on every form
- Login attempt limits and session timeout for inactivity
- Uploaded files checked by their actual content and stored outside the public area
- Audit log that cannot be deleted from within the system
Internal procedures
- Change management: prior backup, testing with fictitious data, approval and change log
- Code security review every 3 months (most recent: November 2026)
- Incident response plan with client notice within 24 hours
Data and privacy
- NOM-035: results only as totals, from closed assessments, with no individual scores; small groups are combined
- Reporting channel stores no name or IP; photos are saved without location or device data
- Givel never sees or stores card numbers: payments are handled by a specialized payment processor
- Payment and invoicing provider keys stored encrypted
- Retention and deletion periods for personal data (under legal review)
Documents
Our internal policies are shared with clients and prospects under a confidentiality agreement. Request them and we will reply within one business day.
Information security policyOn request
Access controlOn request
Data classification and handlingOn request
Backup and recoveryOn request
Business continuityOn request
Incident responseOn request
Vendor managementOn request
Privacy, retention and deletionUnder legal review
Privacy notice (Spanish)View
Frequently asked questions
Who at Givel can see my company's information?
Only the team members who serve your account, according to their role and division (payroll or recruitment). Access is removed the same day someone leaves Givel.
Can the employer see what each worker answered in NOM-035?
No. Results are shown only as totals, once the assessment is closed, with no individual scores, and groups of fewer than 5 people are combined so no one can be identified.
What happens if there is a security incident?
We contain and investigate it and notify affected clients within 24 hours. If it significantly affects the people the data belongs to, they are informed immediately, as the law requires.
Can I ask you to delete my data?
Yes. Write to info@grupogivel.com to exercise your rights of access, rectification, cancellation or objection. We reply within the legal deadlines.
Are you SOC 2 or ISO 27001 certified?
Not yet. We are implementing their controls and collecting evidence; our target is a SOC 2 Type I audit in April 2027. Meanwhile, we share our policies under a confidentiality agreement.
Found a security issue?
Email info@grupogivel.com with the subject "Security report". We appreciate responsible reports and reply within one business day.