Swiss-built. Processed in the EU.
Answerable in writing.
What leaves your workspace at each stage, what every provider actually receives, and where the limits are.
Where a message goes, and what it carries
One message, followed end to end: what travels on, and what stays in the vault.
screening
AI provider EUHTTPSNo training
The commitments
Contract A signed DPA
A data-processing agreement covering the processors we use, with retention horizons and deletion windows written into it. Included with every plan.
Models No provider trains on what you send
Every request includes an explicit instruction that the model provider may not use your data for training. This applies to every model available in the workspace.
Data retention and European processing depend on the individual provider and model. Where available, these protections are clearly shown on each model card.
Cryptography Encrypted where it rests
Vault values, stored conversations and stored documents are sealed with authenticated encryption: AES-128-CBC with an HMAC-SHA256 tag, the Fernet construction. Traffic to providers is HTTPS. Deleting a vault entry destroys the ability to restore the original, which is what makes erasure real against a record that by design cannot be edited.
Residency European processing, and a European-vendor lock
The application and your stored data are processed in the European Union under the GDPR. Model routing used to be a separate question with a different answer; it is not any more. Requests leave through a European gateway that will not route outside Europe, and each one is pinned to a named European processor with fallbacks switched off, so every model you can pick is processed in Europe.
What that does not cover is who BUILT the model, which is a separate question some engagements ask. An administrator can restrict the whole organisation to models built by European companies, which is the setting under which every request is both made by and processed by a European company. Web search is withheld entirely under it, because the search provider's own processing region is not one we pin.
Access What your colleagues and we can see
Conversations are yours: there is no route, including for our own administrators, to read another account's transcripts. A document shared with an organisation shares its values with that organisation by design, and every reveal is written to the record under the reader who did it. Changing your password ends every other session you have open.
Retention How long, and what erasure leaves
Conversations and documents until you delete them, or never, if the workspace runs in store-nothing mode. Account data is deleted when the account is closed; the deletion is immediate and cannot be undone, so take a copy of anything you still need first. The record for ten years, because its purpose is a durable account of what was sent and what was screened, the horizon the professions we serve keep their own files on. Deleting your data removes the content and destroys the mapping that could restore it; the record retains integrity and operational metadata, never the plaintext of a prompt or a response.
The documents
Ask the people who built it.
We answer security questionnaires in your format, sign the data-processing agreement, and put an engineer who built the system on the call. Reach out to us at [email protected] and someone from our team will help.
Who else processes the data, and on what legal basis, is listed in the privacy notice.