What we commit to
Your data. Your terms. In writing.
The three questions every security review opens with, answered directly. Then how that works in practice, and what we put in writing when we work together.
What we commit to
These are the first three questions on most security questionnaires. We answer them per engagement and put the answers in the agreement.
Processed in the EU
Solution data is processed in European regions by default.
Processing runs in EU regions. Where an engagement needs a specific residency arrangement, it is confirmed in writing before we begin.
Never used to train models
We select providers whose terms exclude training on your data.
Enterprise model APIs are used under terms that rule out training on customer content. The providers involved are named, so your own assessment covers the real chain rather than our summary of it.
GDPR handling, in writing
You stay the controller. We act on your instructions.
An Article 28 processing agreement sets out purpose, data categories, duration, subprocessors, security measures, retention and deletion.
What this means for us
Compliance is something we sign, not something we describe.
The commitments on this page are written into each engagement agreement, so your legal team can hold us to them.
Built in costs less
Oversight, documentation and evidence are cheap to design and expensive to retrofit later.
We scope it with you
Which obligations apply depends on the workflow, so we work that through with you and your advisors before the design is fixed.
Evidence, not assurances
You get records and documentation your own reviewers can check, rather than a claim that everything is covered.
How that works in practice
GDPR is legislation, not a certification: you comply with it in a specific processing context. These are the details behind the commitments above.
Minimised by design
The best way to protect data is not to process it.
A solution is scoped to what its workflow needs. Where a task works with less personal data, pseudonymised data or none, that is what we propose.
Named subprocessors
You see the whole chain, not just us.
Model and infrastructure providers are named, with their terms and processing locations. Changes are notified.
Retention and deletion
Your data leaves when you say it does.
Retention is set per data category, with deletion on request and at the end of the engagement, including from backups within defined windows.
Data subject rights
You can answer an access request within the deadline.
Access, rectification, erasure and portability are supported through defined procedures, so you can meet your obligations as controller.
European deployment
A shared EU environment first, your own tenancy later.
Deployment into your own cloud is a later, independently qualified option. What applies to your engagement is confirmed in writing before we begin.
How we hold ourselves to it
Agreed in writing
Contractual terms, not statements on a web page.
Security measures, data handling, oversight and deployment are written into your engagement.
Named responsibility
People, not a policy document.
Every engagement has named people accountable for the commitments made in it, on our side as well as yours.
Open about limits
A vendor who claims everything is a risk in itself.
Where a capability is planned rather than available, or a requirement is one we cannot meet, we say so during scoping.
Bring us your security review.
Your questionnaire, your data-protection requirements and the systems in scope. We would rather work through them now than at the end.