Derived from Employee AI page (Navigator, Autopilot, Companion).
Connects with
Microsoft 365 (Teams, SharePoint, Viva), Workday, ServiceNow, Cornerstone, Google (Drive), Atlassian, SAP, Oracle, ADP; MCP client and A2A for live data; MCP server exposing Staffbase content to Copilot and Claude
'Users cannot modify the AI models, exclude specific inputs, or apply custom generation rules yet'; outputs 'generated based on likelihoods, not guaranteed facts'; Navigator uses only company content, not the open internet
AI features not mapped to a plan on pricing page; AI FAQ refers licensing questions to support/CSM.
Data and controls
Where data is stored
Customer chooses EU or US hosting; EU: Microsoft Azure Frankfurt, Germany (AWS Germany for Email/Bedrock); US: Azure Virginia; also Australia (Azure Australia East)
Sub-processor list (https://staffbase.com/f/f8614b6d17c699f4/staffbase_subprocessor-page_en_v2026q3.pdf): for EU hosting Azure processing 'may occur elsewhere in the EU Azure geography'; Cloudflare stores customer content in region; AU logs/metadata in EU. AI FAQ does not state Azure OpenAI region.
Quote: 'Customer content is not used to train any third-party or Staffbase AI models.' Same on Employee AI page.
Certificates and audit reports
ISO 27001 (Staffbase certification referenced; issuer/scope not named) and SOC 2 (type/auditor not named) per security page; Employee AI page badges also show TISAX, Cyber Essentials Certified, AICPA SOC
The provider’s own sources say different things here. CONTRADICTION/inconsistency: TISAX and Cyber Essentials badges on https://www.staffbase.com/employee-ai not mentioned on security page. Security page partly attributes ISO 27001/SOC 2 to 'hosting facilities' (hosting provider's certificates are not Staffbase's own). https://trust.staffbase.com/ (Drata shell, no content rendered). HIPAA/GDPR are laws.
'Staffbase uses a self-run model and OpenAI Services, both of which are hosted on Microsoft Azure'; AWS Amazon Bedrock for search reranking (no customer content at rest); Azure Translator, Video Indexer, Azure Foundry; sub-processors: Microsoft Ireland (Azure), AWS EMEA SARL, Cloudflare, Stream.io. Bring-your-own-model not offered ('Users cannot modify the AI models')
Model statement from AI FAQ. Sub-processor PDF does not name OpenAI separately (covered under Azure Foundry). Sub-processor page version effective 6 July 2026 per https://staffbase.com/legal/subprocessors.
Product-specific conditions
Deployment
SaaS (multi-region cloud on Microsoft Azure; mobile app, intranet, email)
AI FAQ: 'Any Staffbase features using AI respect existing content permissions.' Whether connector permissions are checked live at query time not detailed.
Questions for the provider
Ask the provider for applicable certificates and attestations, including their scope and validity.
Ask the provider for the price, billing unit and required commitment for your scope.
Ask the provider which retention and deletion terms apply, including when the contract ends.
A written comparison of up to three AI offerings · €195 net
You get the facts that matter for your decision, each with its source, the questions to ask each vendor and a cost estimate based on your own numbers. First you agree your three most important criteria with Sten Franke.
We deliver your brief by email within a maximum of five working days after payment is confirmed and we have agreed the question and minimum information needed to begin. ETHORITY confirms the start date and delivery date and delivers earlier when the reviewed brief is ready. Missing optional information is recorded and assessed; it does not require you to research the solution yourself. Review before delivery and email support are included.
ETHORITY®