Enterprise-ready training without black-box data handling
Where the data lives, how it is encrypted, who can see it - and exactly what reaches the AI models. If your IT or procurement team needs something that is not here, ask us and we will answer in writing. Information current as of 13 August 2026.
The basics
Hosting in the European Union
Production infrastructure and customer data are hosted in the European Union.
Encrypted in transit
Data sent between the user and the platform is encrypted using TLS 1.2 or newer.
Encrypted at rest
Data stored in our infrastructure is encrypted at rest, using the encryption mechanisms provided by our cloud infrastructure provider.
Role-based access
Access follows the user role and the principle of least privilege: people reach only the data and functions their role requires. Administrative access is limited to authorised individuals.
Daily backups, 365-day retention
Backups are taken daily and retained for 365 days. Retention of a specific customer data can also be governed by contract or by arrangements agreed with that customer.
Data processing agreement
We provide and sign a Data Processing Agreement on request, setting out how personal data is processed in line with the GDPR.
What reaches the AI models
What is sent
Only what the function needs
The AI model receives only the content required to deliver a specific function - for example the conversation or its transcript, plus the context needed to generate a response or feedback.
What is not sent
Identifying data stays out
User contact details, organisation contact details, administrative data and other information identifying the customer are not passed to the AI model, unless they are directly required to deliver that function.
Training
Your data does not train our models
We do not use customer data, conversations or transcripts to train AI models. Data processed through the platform serves only to deliver the service to that customer.
Need this in your procurement format?
Send us your security questionnaire and we will complete it. If something above needs to be confirmed contractually, that is what the Data Processing Agreement is for.