What your IT team and DPO will ask, in the order they will ask it
Sixteen questions in four sections, and one we cannot yet answer with a yes.
In the European Union, on a server we name
Which country is the server in?
Hosted in the EU. Helsinki, Finland. The database, files and backups stay here. Text analysis is done by the model provider in the United States; see below.
Is the data encrypted?
The installation runs in a data centre in Helsinki, Finland. Traffic is encrypted end to end; the secrets you hand over — link tokens, webhook URLs — are stored encrypted and never shown on a screen again.
Are there backups?
Nightly backups. With an integrity check and a tested restore — not a file nobody ever opened.
Who notices an outage?
Monitoring. Automatic availability checks; an outage does not wait for you to report it.
What the AI sees — and what it never sees
What is sent to the AI?
No text reaches a model without being cleaned first: emails, phone numbers, tax ids and IBANs are replaced with placeholders. Names written inside the text are not removed, because they cannot be recognised reliably. The author name of a ticket is never sent. The original stays in your database; cleaning applies to what travels, not to what is stored.
Maria from accounts says the invoice came in wrong. Call her on 6900 000 000 or write to maria@example.gr · tax id 099999999.
Maria from accounts says the invoice came in wrong. Call her on [τηλέφωνο] or write to [email] · tax id [ΑΦΜ].
example The placeholders are exactly what the product writes — in Greek, whatever the language. The name stays, as the text above says.
Do you train models on our data?
No training. We do not train any model on your data.
Who is the provider, and where?
The provider is named. The models are provided by OpenAI, which processes the text in the United States. The transfer and its terms are set out in the data processing agreement.
Can we see what was sent?
Every call is logged. Model, purpose, cost and duration — you can see exactly what was spent and why.
Measured, not promised. Every upload tells you how many items were replaced. The count comes from the same rule that made the change, not from a second measurement.
Isolation, roles, keys
Can another customer see our data?
Workspace separation is not a filter someone can forget to write: it is a rule at the database level, and with no workspace identity the data is invisible — not fully visible.
What roles are there?
Four roles. Owner, Lead, Member, Viewer — the role lives on the membership, so the same person can hold different rights in another workspace.
What can an API key do?
Scoped keys. A CI key writes events and cannot read customer voice. Only its fingerprint is stored — the key is shown once.
Are actions logged?
Activity log. Who did what, and when. It is not erased by the actions it records.
Is there a second factor?
Second factor and sign-in history. Authenticator-based MFA is available on every account and can be made mandatory for the whole workspace. Sign-ins, password changes and MFA actions are recorded separately from workspace data: a login does not belong to a customer.
Export, reset, delete
Three different actions, because they mean three different things.
Can we take our data with us?
Export. All workspace data in a file, whenever you ask.
Can we erase it without closing the account?
Reset. The data goes, the workspace stays with its people and settings.
What happens if we leave?
Delete. Everything goes, with a grace period before it is final.
Do you hold ISO 27001 or SOC 2?
A question this page did not answer?
Send it — security and data questions are answered in writing.