Your data, your rules
How daita protects your data, who processes it, and the controls behind it. Written plainly — ask us for the full DPA.
The EU AI Act: what we commit to
The EU AI Act applies in full from 2 August 2026, with fines up to €35M or 7% of global turnover. What daita commits to today: the assistant always tells people it is an AI, your data never trains third-party models, and every agent action is logged with a timestamp. Conversation data is stored in the EU; an EU-region or on-premises deployment can be scoped on Sovereign.
EU-region or on-prem, on request
An EU-region or on-premises deployment can be scoped on Sovereign.
Your data stays yours
Your data never trains third-party models, and you remain its controller.
Concrete GDPR & AI Act commitments
A data processing agreement (Art. 28 GDPR) on request, on every plan, and an assistant that always says it is an AI (Art. 50).
Fully auditable
Timestamped decision logs and traceability for every action an agent takes.
Where your data lives
Built in Munich. Conversation data is stored in the EU; the app servers, the AI model, voice transcription and file attachments currently run in the US under EU Standard Contractual Clauses. In detail: the database is Google Cloud Firestore in the eur3 multi-region (Europe). Communications are encrypted in transit, and every agent action is written server-side to a timestamped, append-only audit trail, exportable on request. Retention is deliberate: every web-chat conversation is also copied in full to a ticket in your inbox — its messages, any attachments, and the customer’s name and contact details — and that ticket, like your leads and bookings, is kept until you or the customer have it erased. What auto-expires after 90 days is the separate conversation record the agent itself works from, along with shopper profiles and analytics events (a pseudonymous copy without conversation text stays 400 days in our EU analytics warehouse). Four parts of the core service are not in the EU today: the application servers that orchestrate every conversation run on US Cloud Run; the language model that writes the replies runs with a US provider under EU Standard Contractual Clauses (an EU path is built but not yet switched on); voice messages a shopper sends — through the website microphone or as an SMS voice note — are transcribed by ElevenLabs, with OpenAI as the fallback when ElevenLabs fails, both in the US and not optional, because transcription is part of the service; and customer-uploaded attachments are held in a US storage bucket, with an EU migration planned. Two more providers are in the US as well: transactional email (Resend) and, when you enable those channels, phone and SMS transport (Twilio) — both listed below among the sub-processors. For regulated workloads, an EU-region or on-premises deployment can be scoped on Sovereign.
- Conversation data in the EU (eur3); app servers, AI model, transcription and attachments in the US
- Encrypted in transit (TLS)
- Timestamped audit trail, exportable on request
- An EU-region or on-premises deployment can be scoped on Sovereign
Who processes data, and where
We use best-in-class providers under data-processing agreements. Each is listed with its role and where it processes data — transparently.
Google Cloud (Firestore, eur3)
Primary data store: leads, bookings, transcripts, audit logs
Anthropic (Claude)
Core reasoning & language understanding
ElevenLabs
Speech-to-text for voice messages (website microphone, SMS) and neural text-to-speech for spoken replies
OpenAI (gpt-4o-mini-transcribe)
Speech-to-text fallback for voice messages when ElevenLabs fails — part of the service, not optional
Twilio
Phone & SMS connectivity
Resend
Transactional email (confirmations, invites)
Sendcloud
Proactive delivery updates — only if you enable them; receives a tracking number and the carrier name, nothing else
OpenAI (gpt-realtime)
Native real-time voice — only if you enable it
AfterShip
Proactive delivery updates — only if you enable them; receives a tracking number and the carrier name, nothing else
Engineered to keep data safe
Encryption in transit
All traffic is served over TLS; secrets are held in a managed secret store, never in code.
Verified webhooks
Phone & SMS callbacks are cryptographically signature-verified before anything runs.
Ephemeral voice tokens
Live voice uses short-lived tokens minted server-side — provider keys never reach the browser.
Least-privilege access
The admin console is password-gated; client workspaces are isolated and token-scoped.
Timestamped audit trail
Every lead, booking and action is logged server-side with timestamps for full traceability; entries are appended, never rewritten by the application.
Bounded retention
Temporary artifacts auto-expire (voice clips ~1h, call state ~24h, and at 90d the agent’s own conversation record, shopper profiles and analytics events; a pseudonymous copy without conversation text stays 400 days in our EU analytics warehouse). Every chat conversation is also copied in full to an inbox ticket, which — like your leads and bookings — is kept until you or the customer have it erased.
GDPR & EU AI Act in practice
You remain the controller of your data. We act as your processor under a DPA, and we never use your data to train third-party models.
Working toward the certifications that matter
Our controls are mapped to ISO/IEC 42001 and ISO/IEC 27001 — daita is not yet certified or independently audited. Formal certification is the goal, and we treat it as a continuous program, not a one-off badge.
AI management system — the first certifiable AI-governance standard. Our controls are mapped to it; daita is not certified.
Regulation (EU) 2024/1689. The assistant always says it is an AI (Art. 50).
EU data protection. A data processing agreement (Art. 28 GDPR) on request, on every plan; access, export and erasure on request.
Information security management. Our controls are mapped to it; Google Cloud, our infrastructure provider, holds its own certificate — daita does not.
AI Risk Management Framework + GenAI Profile — our operational playbook.
LLM application security — prompt-injection, excessive agency and more.
Each status above is what is true today. None of them is a certificate.
Evidence generated from our source code
Instead of a questionnaire, we run an AI-native quality and trust management system that generates evidence from our source code for the controls we track. What code cannot show — policies, agreements, sign-offs — is documented and approved by a named person, and each approval is sealed cryptographically.
Status reflects our active program; certification of an AI management system is granted only by an accredited body. Ask us for documentation.
Need our DPA or a security review?
We are happy to share documentation and answer your security and compliance team’s questions.
This page summarises our practices in plain language and is not a contract. Email info@daita-ai.com for the full Data Processing Agreement and sub-processor list.