EU by default
Your data lives on EU servers (Hetzner Falkenstein/Helsinki) unless you specifically ask us to deploy elsewhere. For client-hosted deployments, your data lives on your infrastructure — we never get a copy.
Trust & data Where your data lives.
Where your data lives.
Who can see it. What we don't do.
We're a small EU agency, not a Fortune-500 vendor. We don't have SOC 2 or ISO 27001. What we do have: EU hosting by default, no LLM training on your data, full data portability, and an honest answer to every question on this page.
No training
Conversation data is never sent to LLM training endpoints. We use the inference-only APIs and we ask the LLM provider to disable training on our key. We can prove this in the model card we ship with every agent.
Article 50 on by default
Every agent introduces itself as AI on first contact and offers a path to a human. EU AI Act Article 50 (transparency for generative-AI interactions) is non-negotiable in our builds.
You own the agent
On project completion you get the source for the agent, the prompts, the tool definitions, and a model card. If you ever want to take it in-house and stop paying us, you can.
Granular retention
Per-agent retention controls. Default: 30 days for transcripts, 12 months for aggregate metrics. Reduce or extend on request, document the choice in the DPA.
Right to be forgotten
Visitor or end-user requests deletion → we have a 30-day SLA to remove from logs, transcripts, vector store and any backups still within retention. Documented per project.
Who else touches your data.
Every project's sub-processor list is documented in the DPA. The set below is the maximum possible — your specific build may use fewer.
| Sub-processor | DPA |
|---|---|
| Hetzner Online GmbH | link → |
| Anthropic | link → |
| OpenAI | link → |
| Cloudflare | link → |
| Resend / SMTP relay | link → |
| Twilio (only when WhatsApp / SMS used) | link → |
Last reviewed: 2026-05-01. We notify clients 30 days before adding any new sub-processor.
Honest gaps.
- ·No SOC 2. Costs $40k+/year and is built for enterprise procurement, not for SME builds at $350–$2,000. If you need it, we're not the right vendor.
- ·No ISO 27001. Same reason. Both will come if/when our clients need them.
- ·"EU AI Act aligned" is forward-looking. The Act is fully applicable from August 2026. We build to its requirements today (Article 50 transparency, model cards, decision logs), but we can't certify against a regulation that isn't fully in force.
- ·GDPR compliant as a processor — no third-party audit to back it up. We comply with GDPR processor obligations (lawful basis, DPA, sub-processor list, data minimisation, right to erasure) and we'll prove each one in writing. We don't have SOC 2 or ISO 27001 to back the claim with an external auditor's signature. Your DPO still needs to sign off on the specifics for your use case.
DPA & security questions.
We have a one-page DPA template, a model-card template, and a Q&A doc covering the 30 most common procurement questions. Email us and we'll send all three.