Trust – five messages with evidence
Every message links to what can actually be inspected. No "we care about privacy" without showing how.
EU data storage
All data is stored within the EU/EEA. A non-EU region stops startup – it is built in, not a promise.
Input wash before the LLM
Personal numbers, email, phone and account numbers are masked BEFORE the text leaves the system – sensitive data is filtered before the call.
Evidence: The wash step in the pipeline (step 2)
Never guesses
Example: ask "what is VAT on consulting services?" with no source in your company and no source in the knowledge base, and the answer is "I don't know" – not an invented figure. Uncertainty is never hidden.
Evidence: The verification step and the refusal · The action list in the closing
Citation in every answer
Every claim points to a document, page number, statute or web source – and you can follow the trace ID back to the full run.
Evidence: Measured citation coverage + methodology · Trace ID per answer
Audit log
An immutable log with who, when and why for every action: the four-eyes rule, final approval and period locking work in practice.
Evidence: The audit log and the four steps
Encryption and logging
- Sensitive fields are encrypted at rest; token keys live in the environment, never in the codebase.
- Logs are washed automatically: no personal data or account numbers in the log stream.
- Secrets are scanned in CI before every build – a leaked key stops the build.
Deletion within 90 days
On contract termination a deletion request is queued automatically with a 90-day deadline – the queue cannot be forgotten manually and every step is logged. You can request deletion now via support.
Incident routine
- 1. Discovery → the status page is updated (the public /status is always open).
- 2. Assessment within 4 hours during service hours; serious incidents around the clock.
- 3. Action, logged in the audit log, and a report to affected customers.
- 4. A post-mortem is published in the changelog.