Security and data
Your data stays in the EU, and the line between companies is in the database
Our own servers in Germany, AI models in the EU and a company boundary the database enforces itself. This is how it is actually set up, written for whoever has to check it.
- Database
- Our own servers in Germany
- AI models
- Vertex AI, EU
- Backup
- Continuous copy in the EU
- Outside the EU
- Closed, opened only on purpose
A boundary in the screen is a promise. A boundary in the database is a limit.
Where the data lives
One database, in one country, with the same rules for everything in it.
The database in Germany
PostgreSQL on dedicated servers at Hetzner in Falkenstein. The machines are ours, not shared with other tenants of a cloud service.
The mirrors in the same database
What we fetch from Visma, HubSpot, Shopify and your other systems sits in the same database, behind the same company boundary.
Encrypted on disk and on the wire
The disks the database runs on are encrypted, and traffic between the browser and the service goes over TLS.
AI in the EU
Hilde and the other AI features use Vertex AI in the EU. A call that would leave the EU is stopped in the code.
Backup in the EU
A base copy and a continuous stream of every change are sent off the database server, to storage in the EU.
The web tier in the EU
The web pages and sign-in run on Google Cloud in Belgium and the Netherlands.
The path to a row
What happens every time someone opens an order, an invoice or a support case. It is the same when Hilde is the one asking.
Sign-in
The session knows who the user is, and which company they are working in right now.
Role and modules
What the user may see, and what the company has enabled, are two independent checks. Both have to say yes.
The database filters
The query runs inside one company, and PostgreSQL row-level security means it only sees that company's rows. A query with no company gets zero rows, not all of them.
The change is recorded
Who, when and what the row was before. Searchable in the product, not a log file somebody has to ask for.
Hilde inherits the same
The AI agent asks with the user's permissions. It sees no more than the person it is helping.
Why "stored in the EU" is not enough as a sentence
Most vendors can say data is stored in the EU. The question that decides anything is what happens when an AI model reads it, and where the backup ends up.
Here the models run in the EU too, and so does the backup. The way out of the EU is a block in the code, not a setting somebody can forget. It opens only by a deliberate choice per environment, and in production it is closed.
Who processes the data
The two subprocessors that hold your data. You get the full list in the walkthrough.
Hetzner Online GmbH
The servers and the database. The machines are in the Falkenstein data centre.
Google Cloud
The AI models (Vertex AI), the web tier and backup storage. Vertex AI does not train models on customer data.
Questions we get from IT
Where does it run?
The database and the application run on dedicated servers at Hetzner in Falkenstein, Germany. The web tier and the AI models run on Google Cloud in the EU. We are happy to walk your IT team through the setup.
Can one customer see another customer's data?
No. Every row belongs to a company, and the database itself filters on it with PostgreSQL row-level security. The interface is not what holds the line: a query with no company gets no rows. The same applies to the AI agent, which inherits the user's permissions.
Is our data used to train models?
No. We do not train models on your data, and Vertex AI does not use customer data for training.
What is sent to the AI model?
Only what the task needs, such as the invoice being read or the case being answered, and only what the user has access to. The call goes to Vertex AI in the EU.
What happens if a server is lost?
The database is copied continuously off the server it runs on, as a base copy and a stream of every change, to storage in the EU. It can be restored from there onto a new machine.
How do we control who sees what?
With roles per user and modules per company. They are two independent switches, so a new module gives no access to a user who does not have the role.
What happens to our data if we leave?
It is yours. The source systems still hold it, and what was created in Workspace can be exported. We do not build lock-in as a business model.
Bring your head of IT
We go through architecture, permissions, subprocessors and data processing in detail, and answer what you need in writing.