DORA Position Statement & AI Use

1. Scope of This Statement

This statement sets out Talexio Ltd.'s ("Talexio") position regarding the applicability of Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector ("DORA" and the “Regulation”), which entered into application on 17 January 2025. This statement is intended for customers, counterparties, and prospective customers who are financial entities subject to DORA and who require confirmation of Talexio's regulatory status for the purposes of their third-party risk management obligations.

2. Talexio's Regulatory Classification Under DORA

2.1. Talexio Is Not a Financial Entity

DORA Article 2(2) defines "financial entities" as comprising exclusively those entities enumerated at Article 2(1)(a) to (t) of the Regulation. That list includes credit institutions, payment institutions, account information service providers, electronic money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, trade repositories, management companies, alternative investment fund managers, data reporting service providers, insurance and reinsurance undertakings, insurance intermediaries, institutions for occupational retirement provision, credit rating agencies, administrators of critical benchmarks, and crowdfunding service providers.

Talexio is an HR and payroll software provider. It does not hold any licence or authorisation under Union financial services law and does not fall within any category enumerated within Article 2(1)(a) to (t). Accordingly, Talexio is not a financial entity within the meaning of DORA Article 2(2), and the substantive obligations imposed on financial entities - including those under Chapters II, III, and IV -  do not apply to Talexio directly.

2.2. Talexio's Position Under Article 2(1)(u)

DORA Article 2(1)(u) references ICT third-party service providers within the entities to which the Regulation applies. To the extent that a customer is a financial entity subject to DORA, and to the extent that Talexio provides that customer with digital and data services through ICT systems on an ongoing basis, that specific contractual relationship may engage the definition of Article 3(19) for the purposes of that customer's own DORA compliance obligations. This classification is relational and context-specific; it does not constitute a general or freestanding regulatory status applicable to Talexio across all customer relationships.

Since Talexio has not been designated as a Critical ICT Third-Party Service Provider under Article 31, no chapter of DORA imposes direct obligations on Talexio. The direct oversight framework of Chapter V, Section II is triggered only upon formal designation by the Joint Oversight Network of EBA, EIOPA, and ESMA, which has not occurred. Accordingly, DORA imposes no direct regulatory obligations on Talexio. To the extent that Talexio's contracts with financial entity customers contain DORA-compliant terms, those obligations are contractual in nature, governed by the applicable law of the contract, and enforceable only by the contracting party  - not by any supervisory authority against Talexio directly.

2.3. Critical ICT Third-Party Service Provider Designation

DORA Article 31 provides for formal designation of ICT third-party service providers as "critical," triggering a direct oversight regime administered jointly by EBA, EIOPA, and ESMA. The European Supervisory Authorities published their list of designated Critical ICT Third-Party Service Providers in November 2025.

Talexio has not been designated as a Critical ICT Third-Party Service Provider under Article 31. The direct oversight framework of Chapter V, Section II accordingly does not apply to Talexio. Talexio will monitor future designation rounds and update this statement if its status changes.

3. Implications for Financial Entity customers

3.1. Customer Obligations Under Articles 28–30

Financial entity customers that are subject to DORA are required, pursuant to Articles 28 and 30, to ensure that their contractual arrangements with ICT third-party providers  - including Talexio -  contain minimum provisions as prescribed by Article 30(2). These obligations fall on the financial entity as the regulated party. Talexio supports its financial entity customers in satisfying these requirements through a dedicated DORA contractual addendum, available upon request and to be incorporated into the master SaaS agreement where required.

3.2. Assessment of Critical or Important Function

Whether any Talexio service constitutes support for a "Critical or Important Function" within a customer's organisation is an assessment that must be conducted and formally documented by the financial entity itself, in accordance with DORA Article 28(2) and the proportionality principle. Talexio is not in a position to make that determination on a customer's behalf. Talexio will, however, provide any technical, operational, or security information necessary to support that assessment.

3.3. AI Usage & Governance

We utilise Artificial Intelligence (“AI”) systems within the framework of providing our services to enhance user experience and operational efficiency. The primary AI provider utilised across our platform is Gemini, with Pinecone utilised for specific vector matching functionalities.  Our AI deployments are governed by strict data processing parameters and operate primarily on a "user-triggered, on-demand" basis (encompassing features such as checklist generation, vacancy descriptions, performance objective drafting, and HR announcements). 

We ensure that any AI processing remains compliant with our overarching data security obligations and does not independently alter core customer data without user initiation.

Talexio confirms that our AI implementations do not make automated decisions that produce legal or similarly significant effects concerning data subjects; all AI-assisted outputs (such as CV parsing) are subject to customer human oversight. Furthermore, customer data is strictly segregated, is never used to train or fine-tune foundational AI models, and is governed by zero-data retention configurations with our AI sub-processors. 

All personnel authorised to process personal data are bound by legally enforceable confidentiality agreements (“NDAs”) and undergo regular, mandatory data protection and security training.

3.4. Register of Information

Financial entity customers are required under DORA Article 28(3) to maintain a Register of Information documenting all contractual arrangements with ICT third-party providers. Talexio is available to provide relevant information regarding its services, infrastructure, subprocessor arrangements, and data locations to support the population of that register.

4. Technical and Organisational Measures

Talexio maintains enterprise-grade technical and organisational measures ("TOMs") governing the security, availability, authenticity, integrity, and confidentiality of customer data, consistent with the security principles referenced in DORA Articles 5–10 as applied to financial entities and informing Talexio's contractual obligations to those customers. These measures include:

     a. ISO/IEC 27001 Certification: Certification for our information security management system, subject to annual independent surveillance audits;

     b. Secure Infrastructure: Hosting within enterprise-grade data centres in the EU, inheriting comprehensive environmental security and DDoS protection features;

     c. Data Encryption: Encryption of all customer data at rest utilising symmetric keys, and encryption of all data in transit utilising  appropriate protocols;

     d. Access Controls: Strict logical segregation of customer data via domain and user identity-based controls, coupled with mandatory two-factor authentication for all internal communications and system access;

     e. Security by Design: Integration of security and GDPR considerations directly into our Agile software development life cycle (SDLC), enforced by automated Continuous Integration (CI) pipelines and mandatory peer code reviews prior to any live deployment;

     f. Vulnerability Management: Automated routine vulnerability scans, complemented by annual formal penetration testing conducted by independent third parties in accordance with industry-standardmethodologies.

     g. Identity & Access Management: Comprehensive multi-factor authentication (MFA) is enforced for all system access, complemented by robust password complexity policies and Single Sign-On (SSO) integration capabilities.

     h. Threat Detection & Perimeter Security: Deployment of Web Application Firewalls (WAF) configured in blocking mode, intrusion detection/prevention systems (IDS/IPS), and centralised logging and monitoring of security events and access logs.

     i. Physical Security & Vendor Management: Physical security controls are fully managed, governed, and certified by our infrastructure provider. Furthermore, all third-party sub-contractors and ICT vendors undergo rigorous due diligence, risk assessments, and are bound by contractual data security and notification mandates prior to onboarding.

Full details of Talexio's security certifications, subprocessor list, data processing locations, and TOMs are available upon written request, including for the purposes of DORA third-party risk assessments and ICT contract registers.

5. Business Continuity and Disaster Recovery

Talexio maintains formally documented Business Continuity and Disaster Recovery plans to ensure the ongoing availability of our services. Our infrastructure is designed for resilience, utilising stateless, deployable-on-demand web servers and Master/Slave database clusters. Database backups are configured with 35-day daily snapshots and are retained across multiple availability zones (eu-central). Furthermore, test restores are executed annually to independently verify data validity and recovery capabilities.  

Our business continuity system outlines specific Recovery Time Objectives (“RTO”) and Recovery Point Objectives (“RPO”), which are formally defined within our customer Service Level Agreements (“SLAs”). The BCP includes documented action plans for diverse contingency scenarios (including cyber-attacks, physical facility disruptions, and personnel unavailability) and establishes formal incident communication channels and escalation procedures to promptly notify customers of any material service disruptions. 

For customers undertaking detailed due diligence, a comprehensive summary of our Business Continuity Plan (“BCP”), including testing results and recovery metrics, is provided in Appendix A: BCP and DRP Summary.

6. Financial Standing

In satisfaction of baseline due diligence requirements regarding corporate financial stability, Talexio relies on its independently audited financial statements. Customers requiring confirmation of our financial standing for vendor risk management purposes are directed to refer to our most recently filed audited accounts, which accurately demonstrate our ongoing financial viability and operational stability.

7. Contact

For queries regarding this statement, Talexio's regulatory position, security certifications, subprocessor arrangements, or the DORA Addendum, please contact: legal@konnekttalexio.com

 

Last Updated: October 2026

Disclaimer: This statement reflects Talexio's position as at the date indicated above. It will be reviewed and updated as required to reflect changes in applicable law, regulatory guidance, or Talexio's operational circumstances. This statement does not constitute legal advice. Financial entity customers should obtain independent legal counsel regarding their own DORA compliance obligations.

 

Appendix A - BCP and DRP Summary 

Talexio is committed to maintaining the delivery of products and services during disruptive events. Our plan ensures that we can recover, respond, and restore operations within predefined business continuity objectives.

Our Core Operational Commitments

We have identified the following key operational processes that we are committed to safeguarding:

  • Sales: Ensuring continuity for business development, demonstrations, and onboarding.
  • Development: Maintaining stability and oversight for information security, data migration, setup, staging, and product releases.
  • Support: Prioritising ongoing customer support and data management.

Disaster Response & Business Continuity Strategy

To protect our customers from disruptions, we have established recovery strategies for various scenarios which are tested on an ongoing basis, including:

  • Systems and Data Protection: We utilise industry-leading SaaS applications with high reliability and availability. We maintain supplementary backup storage locations to protect against data loss or corruption.
  • Operational Resilience: Our infrastructure is supported by redundant systems, including secure infrastructure, backed-up data, and robust communication platforms.
  • Key Personnel: We manage risks related to the loss of key staff through succession plans, employee reviews, and cross-training.
  • Laptop & Asset Security: We maintain strict policies, including mandatory hard disk encryption, antivirus software, and robust replacement procedures to ensure assets remain secure and functional.
  • Office Continuity: In the event of office unavailability (e.g., loss of internet or electricity), our team is prepared to transition to a work-from-home model to maintain business-as-usual operations.

Service Level Commitments

Our commitment to ensure continued access 

Talexio’s service level commitments, reporting procedures, and availability terms for the Service and Software can be found in Talexio’s Service Level Policy.

 

Appendix B 

Granular Security & Infrastructure Controls

     a. Certifications: Talexio maintains ISO/IEC 27001 certification.

     b. Access Management: All access to corporate equipment, internal networks, and the Talexio platform requires Multi-Factor Authentication (MFA). Access policies enforce strict password complexity, expiration, and lock-out mechanisms. Access rights are granted on a strict principle of least privilege and are reviewed annually.

     c. Asset & Vulnerability Management: A formal hardware/software asset inventory is maintained. Automated internal vulnerability scans are performed regularly, and independent third-party penetration tests are conducted annually on all internet-exposed applications and APIs. Critical vulnerabilities are patched immediately in accordance with our formal patch management procedure.

     d. Network & Perimeter Security: The internal network is strictly segmented. We utilise an active Web Application Firewall (WAF) configured in blocking mode to protect against OWASP Top 10 risks (including SQLi and XSS), complemented by DDoS mitigation services and intrusion detection/prevention systems (IDS/IPS).

     e. Endpoint & Physical Security: Anti-malware software is deployed on all workstations and servers. End users do not hold local administrative privileges. Data leak prevention is enforced via device encryption and strict mobile device management. Physical security is governed by industry-standarddata centre controls, which include biometric turnstiles, 24/7 security personnel, and strict ID badge revocation protocols for lost/stolen credentials.

     f. Monitoring: Security alerts, user access logs, and system activity are continuously logged and monitored.

Talexio IT Compliance 

Details of Talexio's IT Compliance measure are available upon written request.

 

Appendix C - Subcontractor Register 

Talexio enforces strict supply chain risk management. Prior to onboarding, all third-party vendors are subject to a formal risk assessment, must comply with our security policies, and are contractually bound to notify us immediately of any disruptions. 

Details of our third-party vendors can be found in our DPA Clause 7 - Sub-processing