Precise, not smooth.

One instance per client, operated by us. No shared tenancy, no shared database, no shared object storage. Only named people have access to your instance.

Primary customer data sits in the EU, in Frankfurt, where the instance is configured that way. The object storage region is set per instance. All regions are confirmed in writing before productive processing.

Inference and PDF rendering run with US providers, under a data processing agreement and standard contractual clauses. We do not claim EU-only processing, because that is not true for the model calls.

We do not train models on your content and we do not pass it on for training. The system works from your approved brand truth. What improves, improves through decisions, not through training.

We do not award ourselves a badge. What the system does: AI labelling on output, human approval before external use, a decision record per generation and an exportable audit trail. Those are mechanisms, not an assurance of conformity.

Your brand truth lives in the open format of the Open Brand Definition Specification and is machine readable and exportable at any time. At the end of a contract you receive the full export. Deletion happens on request and is confirmed.

The list of sub-processors is part of the data processing agreement and is maintained per instance. We provide it in full during a security review, including purpose of processing and region.