GDPR

The platform is designed to operate within the General Data Protection Regulation (Regulation (EU) 2016/679). This page summarises the relevant technical controls and the administrator-side responsibilities.

Data subjects in scope

The platform processes data about:

• End users - name, email, role assignments. Stored in your identity provider and mirrored into the platform.
• Knowledge-base content - uploaded documents. May contain personal data depending on what your team uploads.
• Workflow content - prompts, responses, and metadata. May contain personal data depending on the use case.

Lawful basis

The platform itself does not determine the lawful basis for processing - that is the controller's decision. Common patterns:

• Contract - for end users of your organisation.
• Legitimate interest - for routine business operations.
• Consent - when end users provide personal data for processing by an AI workflow.

Document your lawful basis in your Records of Processing Activities; the platform supports this documentation by exposing clear data-flow boundaries described in the Platform Overview.

Data subject rights

Data minimisation

The platform stores only data needed for the user-facing functions:

• Identity - minimal profile (name, email, roles) sourced from your identity provider.
• Workflows and runs - exactly what the user authored and ran.
• Knowledge base - exactly what the user uploaded.
• Compliance assessments - exactly what the user answered.

There is no behavioural tracking, no analytics SDK that reports back to a third party, and no telemetry that ships personal data outside your environment by default.

Storage limitation

Retention is your administrator's policy. The platform does not auto-delete:

• Workflow run history.
• Generated documents (compliance PDFs, etc.).
• Knowledge sources.

This is deliberate - these constitute audit evidence and should be removed only by an explicit administrator action. Configure retention in line with your retention policy.

Integrity and confidentiality

• In-transit: encrypted at the platform perimeter; internal traffic on the platform's private network.
• At-rest: encryption-at-rest is supported across the platform's data stores. Activation is administrator-configured.
• Access control: role-based access enforced at every protected endpoint; no shared service credentials reach end users.
• Authentication: single sign-on with refresh-token revocation on errors.

Cross-border transfers

By default the platform does not transfer personal data outside your environment. Two exceptions you control:

• External AI provider - explicitly enabling an external provider sends prompts and responses to that provider.
• Hosted observability - choosing the SaaS variant of the audit-trail layer instead of the bundled self-hosted instance.

In both cases, document the transfer in your Records of Processing Activities and apply appropriate safeguards (Standard Contractual Clauses, supplementary measures).

Breach notification readiness

To meet the 72-hour notification obligation:

• Centralise logs in your monitoring tooling; configure alerts on suspicious patterns (failed-auth spikes, unusual data exports, etc.).
• Keep administrator contact information up to date in your runbook.
• Snapshot key evidence (audit logs, configuration, affected records) before remediation actions overwrite it.
• The platform's audit trails supply the source material for the notification.

DPIA support

For high-risk processing, a Data Protection Impact Assessment is required under Article 35. The platform supports DPIA preparation by making the data flow explicit:

• The Platform Overview documents which component touches which data.
• The compliance wizard's risk classification informs the DPIA conclusion.
• Your environment perimeter is defined by your own on-premise deployment.