Where your data is and what the agent never does.
Written for you as a reviewer: where the data is stored, which sub-processors we use, what the agent never does and how everything is logged. Anything that does not exist yet is shown with an expected date.
The short version
- Data
- Stockholm, in Supabase (eu-north-1)
- AI calls
- Stockholm, in AWS Bedrock. The prompts are not stored and not used for training.
- Outgoing
- Always after approval by a person
- Log
- Only grows, can be exported
- Exit
- Full export, deletion after 30 days
Where the data is
Your data is stored in Stockholm. When production opens, the agents will run in the EU, at Hetzner in Helsinki. Prompts to the AI model are sent within the region, are not stored by the provider and are not used to train models.
| What | Provider | Location |
|---|---|---|
| Database, sign-in and files | Supabase | Stockholm (eu-north-1) |
| Web application and server functions | Vercel | Stockholm (arn1) |
| AI calls | AWS Bedrock | Stockholm (eu-north-1), within the region |
| AI calls, alternative route | Azure OpenAI | Data Zone EU |
| Run engines in production | Hetzner | Helsinki Coming spring 2027 |
Sub-processors
The list becomes an annex to the data processing agreement. Changes are announced at least 30 days in advance, with the right to object. Fortnox, Spiris, Microsoft 365 and Google Workspace, which you connect yourselves, are your own providers, not our sub-processors.
| Sub-processor | Service | Location | Purpose |
|---|---|---|---|
| Supabase Inc. | Database, sign-in, storage, queues | Stockholm (AWS eu-north-1) | All customer data in the control plane |
| Vercel Inc. | Web application, server functions | Stockholm (arn1) | Display and API |
| Amazon Web Services EMEA SARL | Bedrock (Claude) | Stockholm (eu-north-1) | AI steps: interpret, assess, create |
| Microsoft Ireland Operations Ltd | Azure OpenAI Data Zone EU if chosen, Microsoft 365 | EU | AI steps as an alternative, notification emails |
| Hetzner Online GmbH | Server for the run engine | Helsinki | Running agents, once production opens |
| Functional Software Inc. (Sentry) | Error tracking | Frankfurt, account details in the US | Error diagnosis with masked personal data |
| ClickHouse Inc. (Langfuse) | Tracing of AI calls | Ireland | Troubleshooting AI steps |
| Grafana Labs | Logs and metrics | Stockholm | Operations with masked personal data |
| Stripe Payments Europe Ltd | Payments, once billing starts | EU | Invoicing |
Cloudflare is used only for DNS and processes no customer data. A PDF of the list will be available when production opens.
What the agent never does
Sends nothing without an approved step
Every outgoing action has an approval in front of it. That is a rule in the spec today and becomes a rule in the engine when production opens.
Takes no orders from what it reads
What is written in an email or an attachment is data, never instructions. A text that tries to steer the agent becomes a case, not a command.
Does not guess
When the agent is unsure, it pauses and hands over to the person you have appointed, with a summary of the situation.
Does not carry on once you have said stop
Off switch and pause per agent. One press is enough, and it is logged.
Log and traceability
- A log that only grows. Every run is logged step by step. The log can be exported but not changed afterwards.
- Versions. Every change to an agent becomes a new version of the spec, with the test results alongside.
- The process document. The readable contract: what it says is what the agent does.
- A hash chain over the log, so that any later change is visible. Coming December 2026
Access
- One organisation per customer, isolated at database level.
- Roles: owner, builder, approver and reviewer.
- Sign-in with email and a one-time code or link. Sign-in with Google: Coming 2027
- Secrets are encrypted at rest and never shown in the browser.
Personal data
- Agreement: the data processing agreement and the terms are accepted when the organisation is created.
- Retention is set per agent. Deletion on request.
- When you leave you get the log, the process document, the spec and the examples. The data is deleted 30 days after the agreement ends, with written confirmation.
- Masking of personal data before it reaches an external model. Coming 2027
The EU AI Act
Coming when production opensWe label AI-generated drafts, so that the recipient can see what an agent has written. The text on our role under the Act will be reviewed by a lawyer before it is published.
Report a vulnerability
If you find a security flaw, email us. We reply within two working days and take no legal action against anyone who reports in good faith.
More questions from your reviewer?
Send them along when you register interest, and we will answer in writing.