Data security
Your data. Securely hosted, clearly documented.
We build on a modern cloud infrastructure with EU hosting, daily automated backups and end-to-end encryption — and openly show what is standard and what can be added on top.
Learn more: How we workWhat every mandate gets today.
A solid baseline. No compromises on privacy.
Every project runs on a vetted cloud platform with European hosting, encrypted storage and automatic backups — no setup or extra purchase required on your side.
Pillars
What's included by default in every KODAX project
EU hosting
Database, file storage and backend run in EU data centres (Frankfurt / Ireland). Your data does not leave the European legal area.
Encryption
All data is encrypted at rest with AES-256 and protected in transit via TLS 1.2+. Passwords are only stored as bcrypt hashes.
Daily backups
The database is backed up automatically every day. Backups are retained for several days — accidental data loss can be rolled back to the previous day.
Row-level security
Every table is protected with fine-grained authorisation rules. Even with a bug in the code, no one can read data they are not entitled to.
Authentication
Login via email + password or Google. Session tokens expire automatically. No access without a valid sign-in.
Audited infrastructure
The platform is SOC 2 Type II and ISO 27001 certified, GDPR-compliant and continuously externally audited. You benefit at no extra cost.
AI without model training
We use AI providers (OpenAI, Anthropic, Google) only via their API under enterprise terms — your content is contractually excluded from training of public models.
Server-side API keys
All AI calls run through our backend. Provider API keys never sit in the browser, never appear in JavaScript and cannot be harvested by end users.
Minimal context to the AI
Only the fields needed for a specific task are sent to the model — not entire tables or dossiers. What doesn't need to leave, stays in your database.
Key figures
The most important facts at a glance
Sources: current compliance documentation of the cloud platform we use. Original documents available on request.
In practice
What this means for you concretely
Your data lives in a professionally operated cloud environment — no Excel files on laptops, no unprotected servers. After a mistake we can restore yesterday's state, and sensitive information is protected at the database level even if an internal bug occurs.
- Even accidental deletion can be rolled back to the previous day
- Data does not leave the EU — no third-country transfer to the US
- Access strictly per user and role, enforced inside the database
- All connections encrypted, including between internal services
- No unprotected plaintext passwords, no open endpoints
Questions about data security?
We're happy to draft an individual data-protection concept for your mandate — based on the standard setup, extended with the add-ons that make sense for you.
hello@kodax.ai