Security and data protection

1. Data location

The system runs in one of two locations. You choose the location before the build begins. In both cases the machine serves one client only.

On hardware you own

We specify the hardware, purchase it and install it. It belongs to you outright and does not depend on anyone, including us.

On a machine we operate for you

A dedicated machine that serves you alone. It is billed monthly. You maintain no servers.

Location of our machines

Several options are offered. The data centre is selected with you before the build.

2. Exclusions

The following applies to both setups:

• Your data does not leave your organisation.
• Your data is not used to train or improve anything.
• No part of the processing passes through an outside AI service.
• No machine is shared between clients.
• Your data is not accessed without your knowledge and approval.

3. AI models

The AI models run on the same machine as your files. They are selected with you before the build, based on what each requires and what it trades off.

4. Access control

Access is role-based. Each person sees only the files they are authorised to open.

Every request, and every action the system takes in response, is logged. The log remains with you.

5. Email

Your email remains with your existing provider, such as Gmail or Microsoft 365. The assistant reads it on your server. No outside AI service processes it.

6. Documentation

The following documents are agreed and signed with you at the start of development, tailored to your requirements:

• Data processing agreement (AVV, Art. 28 GDPR)
• Technical and organisational measures (TOMs)
• System description for your data protection impact assessment (DPIA / DSFA)
• No subprocessors for AI processing; the hosting provider named
• Deletion of all copies, backups included, within 30 days of the end of the contract, confirmed in writing

7. End of contract

On termination you retain the software, its source code, the documentation and a tested export of all data. If we host the system, all of it can be transferred to you at any time.

Within 30 days of the end of the contract, we delete all copies of your data held by us, backups included, and confirm the deletion in writing.

8. Support access

Support access to your data requires your knowledge and approval.

Support begins with a ticket that you raise. We assess the issue and determine which data, if any, it would expose. Before any work starts, we tell you what we intend to do and what we would need to access. If a fix cannot be made without access to data, you decide how to proceed, for example by separating the data first or by not applying the fix. Every fix is logged with what was changed and when. The log contains no client data.

9. This website

This website sets no cookies and runs no analytics. All files are served from this server. Each page instructs your browser to block content from any other source.

Privacy

10. Reporting security issues

Report security issues to the address below. You will receive a reply within one working day.

info@voronda.org