--- title: "Security and data protection: GDPR, EU hosting · AUVY" description: "Customer data stays in Helsinki, AI runs in EU regions and no model trains on your data. Every measure here is written into the data processing agreement." url: https://www.auvy.ai/trust lang: en site: AUVY brief: https://www.auvy.ai/llms.txt --- # Your clients' data, kept in Europe. AUVY stores customer data in Helsinki and runs its AI models in EU regions, and no model is ever trained on your data. Every measure on this page is written into the data processing agreement (AVV), which the trust center publishes in full. [Trust center ↗](https://trust.auvy.ai) [Ask a security question](mailto:security@auvy.ai) Helsinki Where all customer data is stored, on servers we run 0 Models trained on your data 24 h To tell you about a personal data breach 30 days Notice before a new subprocessor, with the right to object By area ## What a security review asks. 1. 01 ### Your data stays yours You can export workspace content at any time, and we delete it within 30 days after the contract ends. AI requests are processed per request under the provider contracts and never used for training, and product analytics runs on our own infrastructure with no third-party analytics. 2. 02 ### Encryption and backups Connections to AUVY and to its providers use TLS 1.2 or 1.3\. Document contents are encrypted with AES-256-GCM under a separate key for each workspace, and secrets of connected accounts are encrypted before they are stored. Backups run daily and weekly, are encrypted with AES-256 and stay in Helsinki for 30 days. 3. 03 ### Access control Each workspace is isolated, and the server decides which workspace a request belongs to. Roles follow least privilege, accounts can use multi-factor sign-in and passkeys, and AUVY staff have limited production access for support and operations only. [The six privacy layers inside a workspace →](https://www.auvy.ai/product/memory) 4. 04 ### Logs and incidents Sign-ins, failed attempts and admin actions are logged centrally, and exports and deletions stay in the workspace activity log for about 12 months. Incidents follow a documented process, and reports to security@auvy.ai are acknowledged within about five business days. 5. 05 ### AI under control AUVY prepares the work, and nothing is sent or changed outside the project until a person accepts it. Each person connects their own accounts, and a connection runs only its published commands and reaches only its listed addresses. [Every command a connection may run →](https://www.auvy.ai/connections) This summarises the measures we run and is not an audit report. The binding text is the AVV and its Annex 2\. [All controls on the trust center ↗](https://trust.auvy.ai/controls) Where data goes ## Every place your data is processed. All of it is processed in the EU. Resend, which delivers system email from Ireland, is a US company, so access from the US is possible under the EU-US Data Privacy Framework (AVV Annex 4). 1. Workspace content, files and accounts Helsinki · Hetzner 2. Live collaboration and meetings Helsinki · run by AUVY 3. AI models and compute EU · Amazon Bedrock, Microsoft Azure, Google Vertex AI 4. Speech to text Sweden · Microsoft Azure 5. Web search EU · Linkup 6. System email Ireland · Resend, a US company The subprocessor list on the trust center is the binding version and names every AI region. We announce any change there 30 days ahead. [Subprocessors and regions ↗](https://trust.auvy.ai/subprocessors) Compliance ## What is in place and what is planned. GDPR · Art. 28 agreement The full AVV is binding in German, with an English translation. published EU AI Act AUVY meets the transparency duties of Art. 50: it says it is an AI whenever asked, a bot signs as an AI the first time it writes to someone on its own, and its images carry a machine-readable credential. The terms rule out prohibited uses and high-risk uses not agreed in advance. in place Professional secrecy · § 203 StGB For Business and Enterprise after written activation under § 12 of the AVV. Until then, such data must not go into AUVY. available Audit rights You or an independent auditor may audit once a year, with 20 business days' notice (§ 9). in the AVV ISO 27001 planned SOC 2 Type II planned Documents ## The current versions, on the trust center. - [**Full AVV (German)** ](https://trust.auvy.ai/docs/avv-de) - [**DPA overview** ](https://trust.auvy.ai/docs/dpa) - [**Subprocessors** ](https://trust.auvy.ai/subprocessors) - [**Data handling** ](https://trust.auvy.ai/data-handling) - [**Privacy notice** ](https://trust.auvy.ai/docs/product-privacy-notice) - [**Terms** ](https://trust.auvy.ai/resources) IT and data protection also ask ### What access to Microsoft 365 does AUVY need? Each person connects with their own Microsoft sign-in, so AUVY sees only what that person can see, and only the mailboxes, teams and sites they connect. Every command a connection may run, and every address it may reach, is published. ### How long do you keep data? Workspace content is typically deleted 30 days after the contract ends and activity logs after about 12 months. Product analytics stay identifiable for up to 90 days and are then aggregated or anonymised. ### Does our works council need to approve AUVY? Usually, because employees work in it. AUVY has no per-person performance views and does not score employees, and we walk your works council through it before rollout. [All questions, by role →](https://www.auvy.ai/questions#it) ## Built in Europe for the people who deliver. [Book a walkthrough](https://www.auvy.ai/walkthrough) [Sign in](https://www.auvy.ai/os/)