Data and security
This applies to data in customer projects. In short, the data is always yours, and it is not used to train models.
Where is the data processed, and which models are used?
In new projects, personal data is only processed on servers in the EU. Where the data is processed in each project is set out in the data processing agreement. Language models that store nothing (via OpenRouter) are only used for data without personal data. The table below shows where each type of data is processed in new projects.
Where is which data processed?
The table covers data in new customer projects. Where the data is processed in each project is set out in the data processing agreement.
| Type of data | Examples | Where it is processed |
|---|---|---|
| Personal data and sensitive data | Names and emails of customers and employees, CVs, health information | In new projects: only on servers in the EU. |
| Confidential information | Client documents at a law firm, patient information, accounting records | Treated as personal data: in new projects only on servers in the EU, never via OpenRouter. |
| Business data without personal data | Price lists, product data, internal procedures, aggregated figures | Servers in the EU, or language models that store nothing (via OpenRouter). |
| Public information | Websites, open registers, published prices | Servers in the EU, or language models that store nothing (via OpenRouter). |
What types of subprocessors do we use?
| Category | Used for | Data |
|---|---|---|
| Cloud provider in the EU | Hosting the solutions and the data | All data in the delivery |
| Language models in the EU | Reading and interpreting content with personal data | Personal, sensitive and confidential data |
| Language models that store nothing (via OpenRouter) | Reading and interpreting content without personal data | Business data and public information |
| Email and calendar at the customer | Alerts, reports and meeting booking | What is in the message or the appointment. Processed in the customer's own email and calendar service, under the customer's agreement. |
A list of subprocessors, and where each of them processes the data, is set out in the data processing agreement and shared in writing before the start.
Is customer data used to train models?
Customer data is never used to train models.
How is responsibility regulated?
We sign a data processing agreement before the start of the engagement. The agreement regulates what we process, why, and what happens to the data when the engagement ends.
What access do we need?
We ask for the least access possible, only to the systems and data the task needs. We use dedicated service accounts for the engagement, so access can be withdrawn when the engagement ends.
Who owns what, and what happens at the end?
The data is always yours. The solutions we build are licensed to you for as long as the agreement runs, and you can buy them out. When we part ways, you get the data exported and the documentation handed over, and the data processing agreement regulates deletion on our side.
What does this page cover?
This page covers data in customer projects. Personal data processed when you use aikias.no is described in the privacy policy.
Questions about data?
Raise it at the free scoping call, or send us a message. We reply within 24 hours on working days.