Your data stays yours, and safe.
How we protect your data in every app, analysis, experiment and AI agent we build. In plain words, and part of every written quote.
How we build
Read-only access
Our apps and AI agents connect to your data with a read-only account, limited to the tables and fields they need. They cannot change or delete anything.
Only the data that is needed
Names, emails and personal identifiers are left out or replaced by codes wherever the work allows. Most analysis runs on totals, not people.
Calculations stay with your data
Numbers are calculated next to your data. An AI service receives only the question and the calculated results, never your whole database.
No AI training on your data
We use business AI services whose terms do not allow training on customer data. Your data is not used to train any model.
Hosted in the EU or with you
We run what we build on servers in the European Union, or inside your own environment if you prefer.
Encrypted
Connections use HTTPS / TLS, and stored data is encrypted. Passwords and API keys are kept in a separate secret store, never in code.
A person approves every action
Agents draft emails, orders and tasks; nothing is sent or changed until someone on your team approves it.
Logged and limited
Every question and answer is logged so it can be reviewed, and usage limits keep costs and access under control.
Separate per client
Each client has its own environment and its own keys and spend limits. No data is shared between clients.
In writing
Data processing agreement
We sign a data processing agreement (GDPR Article 28) before any personal data moves, and a confidentiality agreement if you want one.
Known subprocessors
We tell you in writing which providers we use for your project (for example the AI service and the server host) and where they process data.
Deletion at the end
When the project ends we delete or return your data and confirm it in writing.
Incidents reported fast
If anything affects your data we tell you without delay, and within 72 hours at the latest, so you can meet your own GDPR duties.
How we protect our own side
- Two-step verification on every account we use
- A password manager, with a different password everywhere
- Encrypted laptops with automatic screen lock
- Client data kept on project servers, not on laptops
- Access removed as soon as a project ends
Your rights
You can ask to see, correct or delete personal data at any time by writing to us. You also have the right to contact ANSPDCP, Romania's data protection authority, or the authority in your country.
Questions
Where is our data stored?
In your own environment, or on our servers in the European Union. We tell you the exact location in the written quote.
Does the AI see all our data?
No. Calculations run next to your data; the AI service receives the question and the calculated results it needs to explain them.
Is our data used to train AI?
No. We use business AI services that do not train on customer data.
Can the agent change our systems?
Not without you. Access is read-only, and any action it prepares waits for a person to approve it.
Do you sign a DPA?
Yes, always, before any personal data moves. We can also sign your own template.