Data Policy
Compliance, encryption, AI processing, retention, residency, and your data-subject rights.
Version: 2026-05
Compliance
GDPR alignedCCPA alignedDPA available on requestSOC 2: audit in progress Sub-processor list publication pending
Encryption
In transitTLS 1.3
At restAES-256-GCM via AWS KMS envelope encryption for credentials; AWS S3 SSE-KMS for files
Key managementAWS KMS customer-managed key (CMK) with per-tenant EncryptionContext
Data residency
RegionsEU
Primary countryFI
All processing stays within the EU ComputeEU (Stockholm)
StorageEU (Stockholm)
AI inferenceEU (Finland)
Frontend CDNEU (Stockholm)
AI processing
Inference providerVerda (Finland)
External providersNo external LLM providers
Customer documents are never used to train models Retention
Default retention30 days
API results retention30 days
Free tier ceiling30 days
Highest paid ceiling365 days
Trash grace period7 days
Pre-deletion warnings7d, 3d, 1d
Customer-defined per workspace (within plan ceiling)Immediate (skip-trash) delete supported Data subject rights
Right of access (Article 15)Supported Right to rectification (Article 16)Supported Right to erasure (Article 17)Supported Right to data portability (Article 20)Supported Maximum response window30 days