Security & compliance
Built so your data protection officer can say yes.
Where data lives, who can see it, what gets logged, and how we document it under GDPR and the EU AI Act. All of it written down before your project starts.
Security & GDPR one-pager
Everything on this page in a two-page PDF for your DPO and IT security team.
/ 01 — The essentials
Six questions, answered up front.
Where your data lives
In an EU region of AWS, Google Cloud or Azure, whichever you already trust. Or in your own cloud account or data centre. Data is encrypted in transit and at rest.
Which model sees it
Sensitive data is processed by open models we run on dedicated infrastructure. General tasks can use managed models in the EU, only if you approve. Your data is never used to train public models.
Who can see what
Single sign-on through Microsoft Entra ID, Google Workspace or Keycloak. The assistant respects the permissions in your source systems: nobody sees an answer from a document they couldn’t open.
What gets logged
Questions, answers, sources and agent actions, with retention periods you define. Logs are available to your administrators and auditors.
Who owns the system
You. We build on open-source components and hand over code, configuration and documentation. No lock-in to us or to a single model vendor.
How we work securely
Our information security management is certified to ISO 27001:2022. Code is reviewed, tested and deployed through automated pipelines.
/ 02 — Your documents
The documents you receive with every project.
| Document | What it covers | For |
|---|---|---|
| Data processing agreement (DPA / AVV) | Our obligations as processor under Art. 28 GDPR | |
| Sub-processor list | Every cloud and model provider involved, and where they process data | |
| Technical and organisational measures | Encryption, access control, backups, incident response | |
| EU AI Act classification | Risk category of the system and the obligations that follow | |
| System description | What the system does, which data it uses, what it records about users | |
| AI usage policy (template) | Rules for employees on using AI tools |