Trust center
Your data stays yours. Safe by design.
Businesses trust [prompt.exc] with their people, money and customers. Security, privacy and responsible AI are designed into every app — not added at the end.
Never used for training
Your data does not train AI models
Hosted in the EU
Helsinki, Finland, fully managed
AI with your permissions
Sees only what the person can see
Every action audited
A log that cannot be edited
Safe, responsible AI
AI that works for you — never on your data.
Your data never trains AI models
We do not use customer data to train or fine-tune any model, and customer workspaces run AI only through providers whose terms exclude customer data from training.
Enterprise AI providers
Customer workspaces run AI through enterprise-grade services such as Amazon Bedrock or Azure OpenAI, under commercial data-processing terms, in a region agreed in your contract.
AI only sees what you can see
The assistant acts with the person’s own role and permissions. It cannot read a record, field or app that person could not open themselves.
People decide, AI prepares
Consequential actions wait for the person’s own Confirm, bound on our server to the exact action and record. The AI model cannot confirm for anyone.
Minimum data, every request
Only the records a request needs are sent to the model, and every AI action is written to the audit trail with who asked and what changed.
You stay in control of AI
The assistant works only in the apps your organisation has switched on, and a per-organisation switch to turn AI features off entirely is rolling out.
Data protection & privacy
Your data stays yours — separate, private and portable.
Hosted in the EU
Your workspace and database are hosted in Helsinki, Finland, on infrastructure we fully manage, behind Cloudflare.
Each organisation kept separate
Every query is scoped to your organisation and checked the same way in chat, apps and the API.
Encrypted in transit
All traffic uses TLS, and credentials and sign-in secrets are stored encrypted. Encryption of the full database at rest is on our near-term roadmap.
Privacy tools built in
Export or erase an individual’s personal data, keep a record of processing, and restrict sensitive cases such as grievances to named people.
Your data, always exportable
Administrators can export the organisation’s full data at any time, with a second administrator’s approval.
Never sold, never shared
We do not sell customer data or share it with anyone except the processors needed to run the service, listed in your contract.
Platform security
Controls your auditors expect, on by default.
Role-based access to the field
Access starts from role templates, with field-level masking for salaries, bank details and other sensitive data.
Two-person rules
Salary bank changes, large manual journals, MFA resets and full data exports need a second approver.
Audit trail that can’t be edited
Every create, change, approval and AI action is logged. The audit log and the ledger refuse edits and deletes at the database.
Strong sign-in
Authenticator-app MFA with recovery codes, enforced for privileged people, plus single sign-on over OIDC and SCIM provisioning.
Encrypted calls
Call audio, video and screen are encrypted in each browser; our media server relays them without being able to decode them. Calls are not recorded.
Backups and recovery
The database is backed up nightly, and a deleted organisation stays restorable for 30 days.
Where your data lives
Named plainly, agreed in writing.
We host and fully manage [prompt.exc]. There is no infrastructure for your team to run, and the details below are confirmed in your contract.
- Application & database
- Helsinki, Finland (EU), fully managed by Globalion
- Edge
- Cloudflare, in front of every request
- AI processing
- Enterprise AI service (Amazon Bedrock or Azure OpenAI), region agreed in your contract
- Model training
- None — customer data is never used to train models
- Deployment
- Hosted and managed for you — no infrastructure to run
Working towards
What we are still building.
Trust also means being straight about what is not finished. Ask us for dated status at any time.
Encryption at rest
Full database-level encryption at rest is on the near-term roadmap.
Certifications
We are working towards ISO 27001 and SOC 2. We do not hold them yet — ask us for the current roadmap.
Published RTO / RPO
Offsite backup redundancy and published recovery objectives are being built out.
Privacy notice, DPA & SLA
Being finalised. Current drafts are shared during procurement.
Have a security or procurement question?
We will walk your security and risk team through the specifics and confirm anything you need in writing. Or email hello@promptexc.com.