Orbio

Eight systems are named individually across three classes: HRIS and core HR in Meta4, Workday, BambooHR and Bizneo; applicant tracking in Lever, Teamtailor and Bullhorn; and CRM in Salesforce. The vendor's framing: "Orbio integrates seamlessly with your stack for richer data and faster action. Plug into the tools you already use."

The agents act through these systems, not just beside them. They screen, interview, schedule and run onboarding, and they reach candidates and workers over the customer's own channels: "24/7 outreach: reach candidates across time zones via calls, WhatsApp, SMS, and much more."

Orbio also ships its own "built-in applicant tracking system to manage recruitment and candidates, hosting custom career pages and source tracking", so records are written as well as read, and deployment is described as seamlessly placing the agents "into your existing systems". Three named ATS platforms alongside its own means the product is built to sit in a customer's incumbent stack rather than replace it.

The integrations strip names systems without stating the direction or depth of each connector, and "for richer data" reads as inbound. No connector directory, per system documentation or sync description is published, so what Orbio writes back into Workday or Bullhorn, as against what it reads, is not stated.

Sourceorbio.work homepageread 2026-09-12

Three specialized agents cover the whole employment lifecycle. The homepage states "three specialized agents work across your stack to run end-to-end HR from job post to retention insights", presented as a switchable set covering Recruitment, Onboarding and Employee Insights, with Our agents as a top level navigation item. María is the named recruitment agent and has her own page: "Tell Maria the need, and she goes always-on, from job description to onboarding", with stated expertise in recruitment and sourcing and the ability to detect talent and manage the hiring process.

The sequence is continuous rather than three separate tools. Signals cross the stages, so onboarding and engagement outcomes inform who is selected next, and the product is sold as one system from job post through retention. Live retention insights "know who's likely to churn way before they do", which is the last stage feeding back. The participants are distinct: the HR team that states the need, the three agents, the candidate or worker reached over calls, WhatsApp and SMS, and the human validator whose sign off is mandatory on critical HR decisions.

No orchestration runtime is named, no handoff protocol between the agents is described, and there is no authoring surface. The flow is Orbio's HR process, configured to the customer's policies by Orbio's own team during implementation. Of the three, only María is named.

Sourceorbio.work homepage and /agents/mariaread 2026-09-12

The agents ground on the customer's own data, and that data persists. Orbio ships a "built-in applicant tracking system to manage recruitment and candidates, hosting custom career pages and source tracking", and integrates with Meta4, Workday, BambooHR, Bizneo, Lever, Teamtailor, Bullhorn and Salesforce "for richer data and faster action". On top sits a longitudinal profile of each worker built across recruiting, onboarding and retention: a maintained store that stands between runs and grows with use.

Retrieval shows on every response. The security page states that "transparent reasoning, source references, and confidence scoring" accompany every AI generated response. Source references on each response mean the agent is grounding on identifiable material rather than answering from a model's general knowledge.

The agents decide from that accumulated record. Matching finds "better-fit candidates with fewer false positives and higher pass-through quality", and retention insights "know who's likely to churn way before they do", both judgments formed over the customer's accumulated record rather than a job description alone. No page names an index, an embedding store or a retrieval mechanism, so the structure behind the persistence and grounding is not published.

Sourceorbio.work homepage and /securityread 2026-09-12

Human validation is required, not optional. Under its human in the loop controls, the security page states "AI management aligned with responsible AI principles, ensuring critical HR decisions require mandatory human validation and oversight." The agent cannot complete a critical HR decision without a person validating it, which is a shipped review and approve gate rather than a promise to keep people involved.

The validator is equipped to judge. Every AI generated response arrives with "transparent reasoning, source references, and confidence scoring", so the person sees the basis and the model's own certainty before deciding. Enforcement also runs before anything executes: defenses against "prompt injection, prompt tampering, and output filtering prevent model misuse or leakage of sensitive info", and environment isolation bounds what the agents can reach.

Which decisions count as critical is not defined, and no configurable threshold, approval queue or escalation path is documented, so a buyer cannot see where the line falls or move it.

Sourceorbio.work/securityread 2026-09-12

Attestations are claimed as held, not in progress. Orbio states it is "ISO 27001 certified, SOC 2 Type II audited, GDPR-aligned, and ready for the EU AI Act", with four compliance marks on both the homepage and the security page and no in progress caption on any of them. Testing is independent: "independent security validation by CREST-approved vendors with comprehensive infrastructure and application testing", which names an accreditation body for the testers rather than just claiming a pentest. A trust center is published at trust.orbio.work.

Access and control: under Strict Access and Audit Controls, role based access, behavioral analysis and an immutable audit trail; under Robust Infrastructure Security, "environment isolation, encrypted data at rest and in transit, continuous vulnerability monitoring, and proactive threat detection". Two further commitments matter on an HR product: a zero training guarantee that customer data is never used to train AI models, "contractually enforced and technically protected", and privacy by design covering data minimization and user consent management.

The marks appear without certificates or stated scopes, so the attestations rest on the vendor's own statement.

Sourceorbio.work/security and homepageread 2026-09-12

The audit trail is named, covers the agent, and is immutable. Under Strict Access and Audit Controls the security page publishes "a comprehensive, immutable audit trail capturing all user actions and AI interactions": both people and agents, with immutability stated.

AI specific monitoring is a named product area. Under AI Observability and Management: "AI monitoring with full input/output logging, continuous response evaluations, and prompt versioning for secure, controlled AI interactions." Full input and output logging gives a record that can be reconstructed, and prompt versioning tells a reader which version produced a given output.

Each response also carries its own explanation: "transparent reasoning, source references, and confidence scoring" accompany every AI generated response, so a reviewer sees not only what the agent did but what it read and how sure it was. The same controls include role based access, and the continuous evaluations and prompt versioning double as a loop for testing changes.

Sourceorbio.work/securityread 2026-09-12

What looks like memory here is the customer's HR data, and no agent memory is documented. A longitudinal profile per worker is held because Orbio ships a "built-in applicant tracking system to manage recruitment and candidates" and syncs from Workday, BambooHR, Meta4 and Bizneo. That record is what the agents read, grounding data rather than memory the agents keep.

Signals from later stages feeding back into decisions are model learning, not a store. The vendor says so in its own words: "Our AI agents continuously learn and improve based on feedback and changing HR requirements." Learning embedded in a model improves the system, but it is not something a customer can point at, inspect or clear.

Nothing on the site describes a named memory layer, a retained preference set the agents reapply, decision traces carried between runs as an inspectable object, a stated scope or lifetime, or a customer control to inspect, edit, export or purge agent state apart from the worker records. The security page makes the absence plain: it lists the AI governance surface down to prompt versioning, input and output logging, confidence scoring and an immutable audit trail, and names no memory component among them. Those logs are a record of conduct, not memory.

Sourceorbio.work homepage and /securityread 2026-09-12

Orbio states a residency commitment at the inference layer. Under its own heading of localized AI inference: "LLM inference occurs within the EU for EU clients and follows data sovereignty compliance for clients based in the Americas." That names the EU as a place, at the layer that is hardest to localize and that most vendors leave silent. Around it sit environment isolation and encryption at rest and in transit.

Only one geography is named as a location. The Americas half is a compliance posture rather than a place: it says a rule is honored, not where the data sits. No region list, named customer environment or selection surface appears, and placement follows the client's domicile rather than the customer's choice, so an EU buyer has nothing to decide. The company also publishes a trust center at trust.orbio.work and runs an application host at admin.eu.orbio.work.

Sourceorbio.work/securityread 2026-09-12

Orbio ships three complete agents, each doing a different job: a recruitment agent taking a role from job description through screening and interviewing, an onboarding agent, and an employee insights agent producing retention signals. They are presented as a set ("Meet your new HR team") under an Our agents navigation item, and María has her own page at /agents/maria with her expertise and strengths listed.

Each stands on its own. Remove the insights agent and recruitment is still a whole product that fills roles; remove recruitment and onboarding still onboards people hired elsewhere. These are not three modes of one engine or three tiers of a price list.

They arrive prebuilt rather than authored: there is no builder, studio or template gallery anywhere on the site, and a customer receives working agents on day one. Tailoring is a managed step, not self serve. The implementation sequence states "our team configures AI agents tailored to your specific HR processes, policies, and company culture" and "we seamlessly deploy the AI agents into your existing systems". So a buyer chooses among three prebuilt agents but does not configure them alone, and nothing states whether the three are licensed separately or arrive as one bundle.

Sourceorbio.work homepage and /agents/mariaread 2026-09-12

The channel set is named, and it is the right set for this buyer: "24/7 outreach: reach candidates across time zones via calls, WhatsApp, SMS, and much more." Voice, WhatsApp and SMS are three distinct modes, and they are the ones that reach frontline and deskless workers, who usually have no corporate email address.

The contact page offers a "live call with Maria, our AI talent acquisition assistant", confirming voice is a real synchronous channel rather than a notification. Reach extends to more than 60 languages, engaging everyone in their native language. Custom career pages with source tracking ship with the ATS, so an application is an event arriving in the pipeline.

The agents run always on rather than waiting for an operator: they work "at any time, any moment" and across time zones, and retention insights run continuously enough to flag churn risk "way before" it happens. Events drive the later stages: replies are qualified, a hired candidate passes from recruitment into onboarding, and engagement signals trigger retention flags.

Beyond the three named modes, "and much more" names no channel, and no cadence control lets a customer set the interval between touchpoints.

Sourceorbio.work homepage, /security and /contactread 2026-09-12

Which model runs is never stated, and the customer chooses none. The security page discusses LLM inference, prompt security, prompt versioning and model misuse, and the homepage and agent pages describe what the agents do, but no page names a model or a provider: not for screening, the voice calls, matching or the retention signals. There is no model picker, admin setting, per agent assignment or bring your own key path.

What Orbio does disclose about models is governance rather than choice: "LLM inference occurs within the EU for EU clients", a zero training guarantee that customer data is never used to train AI models, "contractually enforced and technically protected", and prompt versioning. A vendor that publishes where inference runs and how prompts are versioned while naming no model is not withholding a choice; there is none to state. The engineering blog at blog.orbio.work carries posts on the inference pipeline.

Sourceorbio.work/security and homepageread 2026-09-12

No developer API, SDK or MCP surface is published. Orbio runs three subdomains: trust.orbio.work, a trust center; blog.orbio.work, an engineering blog with posts on the streaming pipeline, speculative prefetching and caching behind sub second replies; and admin.eu.orbio.work, an application host. None is a developer or documentation surface, no docs host is published, and no API reference, endpoint list, authentication guide, SDK, webhook or MCP server appears anywhere.

The integrations point the other way. Meta4, Workday, BambooHR, Bizneo, Lever, Teamtailor, Bullhorn and Salesforce are systems Orbio reaches into; nothing documents an outside system or an outside agent calling Orbio.

The commercial shape fits the gap. Implementation runs Analyze, Configure, Deploy, Optimize, with Orbio's own team configuring and deploying the agents into the customer's systems, so there is less reason to publish a build surface, and the blog is written about the platform rather than for people building on it.

Sourceorbio.work homepage, /security and subdomain proberead 2026-09-12

Orbio evaluates its agents' output continuously and versions its prompts. Under AI Observability and Management the security page lists "AI monitoring with full input/output logging, continuous response evaluations, and prompt versioning for secure, controlled AI interactions." A change to the agent's instructions is a tracked object and its output is assessed after it ships: a quality gate over the agent's own output with change management attached. Confidence scoring on each response gives the evaluation a signal per item.

It stops short of a readable test harness. No score, pass rate, judge verdict, test set or before and after comparison is published, and nothing states that a new prompt version is run against a known set before it reaches candidates rather than evaluated afterward. A loop whose output a customer cannot read is a gate, not a harness.

No bias or fairness audit of the screening criteria is published. For a vendor screening frontline candidates at volume under the EU AI Act, that absence matters to a buyer. The Optimize step of implementation, where "our AI agents continuously learn and improve based on feedback", is model learning rather than testing.

Sourceorbio.work/security and homepageread 2026-09-12

Nothing here drives a browser or a computer, and the product's design makes the absence clear. The agents reach people "via calls, WhatsApp, SMS, and much more" in more than sixty languages, and they reach systems through named connectors into Meta4, Workday, BambooHR, Bizneo, Lever, Teamtailor, Bullhorn and Salesforce, plus Orbio's own built in ATS. Talking to a candidate on WhatsApp and writing a record through a connector are both nonvisual; neither navigates an interface.

Voice is the one thing that could be misread. A live call with Maria is telephony: an agent conducting a phone interview is operating a voice channel, not a computer. No hosted or local browser, desktop session, remote or local computer control, RPA or extension is documented. There is not even a sourcing browser extension, because sourcing runs against Orbio's own pipeline rather than on pages a recruiter has open. Nothing the product does depends on what is drawn on a screen.

Sourceorbio.work homepage, /security and /contactread 2026-09-12