The key that decrypts your token map is returned once, directly to you, and is never stored on the server. A memory dump on its own would be worthless.
Where your data goes. And where it never does.
One document, six hops. Real values stay between you and an EU server that forgets them; the model only ever sees tokens.
- Original document
- Session key — returned once, only to you
- Tokens to send on
- Restored reply
- Detectors run in memory
- Token map — encrypted, in memory, TTL
- Database of your values
- Training on your content
- Your key at rest
- Receives <PERSON_1>, <IBAN_1> …
- Answers with the same tokens
- Names, numbers, addresses
- Your session key
The record that empties itself.
One session, then gone. Up to 4 hours on Free, 24 hours on paid plans.
Where it runs. What we never do.
Plain answers to the questions a security review asks first.
Hosted in the EU
Our infrastructure runs inside the European Union. If you point "Ask the model" at a provider outside the EU, only tokens travel — never the original values.
Your key is never stored
The secret that decrypts your token map is returned once, to you. We keep a hash of API keys, never the key — a full copy of our servers would still restore nothing.
Never used for training
Your content is not used to train models, not sold, and not shared with anyone you didn't choose as a destination. Sub-processors work under a data-processing agreement.
Encrypted in transit, gone at rest
Every request runs over HTTPS. The token map exists only in memory for one session; there is no database table of your values to encrypt, back up or leak.
Where each one stands today.
GDPR by design. The rest is in progress — no badges we haven't earned.
Nothing to leak. Nothing to breach.
Keep using AI on real work — the sensitive part never leaves your side. Set up in minutes, or talk to us about a company-wide rollout.