Where data lives
EU (Frankfurt) by default, on Supabase PostgreSQL with Row-Level Security at the database layer and brand-scoped retrieval, so an agent can only ever read the records belonging to the brand it is working for. Clients with stricter residency requirements get a dedicated instance, or the same architecture built inside their own infrastructure.
What the models see
Prompts and retrieved context go to the frontier models the router selects for that task. No client data is used to train any model. Where a client requires that data never leave their jurisdiction or their tenancy, that is the build track, and it is one of the two reasons the build track exists.
Subprocessors
Model providers, the search providers behind live research, and the hosting and database platforms. The list changes as the router changes, so it is maintained per engagement in the DPA rather than published here where it would go stale — ask and we will send the current one before you sign anything.
Access, inside an engagement
Least privilege, time-boxed to the engagement, through your own identity provider wherever you have one. We do not ask for standing production access, and a diagnostic needs read access to schemas rather than to data.
IP and what transfers
On the build track: the system, the source and the IP transfer to you at handover, with no residual licence back to us. On the deploy track the platform stays ours and your brand context, prompts and outputs stay yours — including if you leave, in which case you get an export rather than an argument.
AI Act posture
We classify the provider-versus-deployer role for every system we install, because every other obligation follows from it. Article 50 transparency obligations have been in force since 2 August 2026 and apply to any public-facing AI interface or AI-generated content we help you ship — including the imagery.
Incidents
One route, one clock. Anything material reaches your named contact within 24 hours of us knowing, with what we know and what we do not yet know stated separately, and the NIS2, GDPR and AI Act reporting windows tracked from that same moment rather than from a later triage.
This page has a date on it.
Last reviewed 2026-08-20. Security pages rot faster than almost anything else on a site, and one without a review date is asking you to trust a statement of unknown age. If what you need is not here, ask — the answer will either be a fact or "we do not do that yet", and both are more useful than a page that implies otherwise.
Need the DPA and the subprocessor list?
Both go out before a diagnostic starts, not after. Ask and they arrive the same day.