Your data stays yours. Here is exactly how.

• Hosting region

  You decide where systems and data live. We recommend and build for:

  • Your own infrastructure or private cloud, on-premises if required
  • On AWS in Switzerland (Zurich region) or in an EU region, whichever you choose
  • Model endpoints in Switzerland or the EU where the provider offers them, otherwise self-hosted open-weight models
  • No transfer outside Switzerland / EU without your written consent

• NDA and DPA

  Contracts come first, data second.

  • We sign your NDA, or provide a mutual NDA, before the first conversation about internal details
  • Data processing agreement (DPA / AVV) under Art. 9 nDSG and Art. 28 GDPR before any personal data is processed
  • A list of every subprocessor (e.g. cloud and model providers), approved by you
  • Confidentiality obligations for every team member and network partner on your project

• How we handle your data

  We process only what a task needs, for as long as it needs it.

  • Start with anonymised, pseudonymised or synthetic data wherever possible
  • Encryption in transit (TLS) and at rest, separate environment per client
  • Least-privilege access with MFA, access logged and reviewed
  • No training of models on your data; provider options for zero data retention are enabled where offered
  • Personal data masked in logs and traces
  • Return or deletion of all data at project end, confirmed in writing

• AI-specific safeguards

  AI systems get their own threat model, on top of normal security.

  • Defences against prompt injection and data exfiltration through tools
  • Agents get the narrowest permissions possible; risky actions need human approval
  • Evaluation suites and red-team tests before go-live and on every change
  • Audit trail of model inputs, outputs and tool calls, with retention you define
  • Practices aligned with the OWASP Top 10 for LLM applications

• Engineering practice

  The same discipline as any production system.

  • Code review for every change, automated tests and dependency scanning
  • Secrets in a vault, never in code or chat
  • Infrastructure as code, so environments are reproducible and reviewable
  • Documentation and handover, so your team can operate the system without us

• Incidents

  If something goes wrong, you hear it from us first.

  • Notification without undue delay if a security incident affects your data
  • Root-cause analysis and a written report with corrective actions
  • Support with your own reporting duties towards the FDPIC or EU authorities

This website: This website runs on AWS in Frankfurt (EU) and is delivered through CloudFront. No cookies on page load, no analytics, no tracking pixels. Fonts are served from our own server. The Cal.com booking calendar loads, and may set cookies, only after you click a booking button. Details in the privacy policy.