What employment data does AI process without violating the law?

The use of artificial intelligence in human capital management has transformed the operational efficiency of organizations. However, managing sensitive employee information carries high-level legal responsibility in Mexico. With the entry into force of stricter privacy regulations and constant monitoring by INAI, Chief Technology Officers (CTO), Legal Directors, and HR Directors must have absolute clarity regarding the legal limits when digitizing their workforce's information.

The regulatory framework for labor data in Mexico

The Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) classifies employee information into different categories. When implementing automated systems, the company acts as the "Controller" of the processing, while the technology platform operates as the "Processor".

To operate in strict compliance with the law, the data that Sora's AI processes to build the employee file is divided into:

1. Identification and Contact Data: Name, CURP, RFC, address, and email. These are essential for drafting individual employment contracts and addenda.

2. Labor and Financial Data: Position, salary, working hours, incident history, and attendance records. Necessary to verify labor compliance according to the Federal Labor Law.

3. Facial Biometric Identification Data: Face and proof of life for identity authentication.

[Employee Data] ➔ [Informed Consent] ➔ [Zero-Knowledge Encryption (ed25519)] ➔ [Secure Cloud Storage]

Informed Consent for Facial Identification Data

Processing the image of the employee's face requires informed consent for biometric data processing in HR. This cannot be an implied agreement; it must be explicit, prior to processing, and with purposes clearly limited to identity verification for signing labor documents.

At Sora, this procedure is seamlessly integrated during digital onboarding. The user authorizes the privacy notice, and the platform performs a real-time query against the official RENAPO database to verify the authenticity of the identification. The facial capture is not stored as a simple accessible photograph, but as an irreversibly encrypted vector representation.

Cryptography and the Zero-Knowledge Principle

A recurring fear when adopting secure cloud storage for labor contracts and documents is the risk of leaks or unauthorized access by the software provider. Sora resolves this dilemma through high-level cryptographic architecture:

• ed25519 Algorithm: Each signature is executed using a pair of unique mathematical keys (public and private).

• Nontransferable Secret PIN: The signature is generated locally on the user's device upon entering a personal PIN.

• Zero Knowledge: Neither Sora nor its servers know or store this PIN. The private key remains under the exclusive control of the signer.

This architecture ensures that no third party —not even the platform itself— can alter the documents or impersonate an employee's identity.

Clarification of Operational Scopes

It is essential to point out that Sora's technology is designed for internal legal protection, contract auditing, and the traceability of files in the cloud. Sora DOES NOT perform procedures, reviews, validations, or inquiries before the IMSS. The information stored in Sora's digital file serves as documentary support and irrefutable proof before STPS inspections or disputes in Labor Courts, leaving management with social security agencies to be done through their respective official portals.

By implementing Sora, Mexican companies achieve perfect synergy: deep automation with artificial intelligence, strict compliance with the LFPDPPP, and absolute legal certainty in every digital contract.