Secure and European
Plenty of agencies put a padlock on their site and call it secure. This page lists which suppliers I use, which country their servers are in, what they get to see of your data and how long anything is kept. If your company sits outside the EU and wants customers inside it, this is the part you will be asked to show. Your IT lead can check every line.
Everything on this page can be checked. If the setup changes, this page changes before that change goes in.
This is the setup I put in place for a project, with the regions fixed in the settings. These are not numbers about systems already running at clients, because there are none yet.
With AI the question that matters comes down to one thing: which text leaves your company, and where does it end up. Here it is per type of data, with nothing dressed up.
Why this split matters. The worry about AI is almost never the database. That sits in Germany, same as your accounting package. The worry is that one moment when text goes to a model. So for every process I write down which text that is, how long it sits there and who can ask for it.
This is the complete list for a standard project. If something gets added for you, you hear about it before I switch it on and it goes into your data processing agreement. The region codes are there so your IT lead can look them up.
fra1 ams1eu-central-1eu-west-1What to notice here. Three of these are US companies with servers in Europe. For most companies that is fine and their European contracts cover it properly. If you want no US parent company in the chain either, the EU-only option is further down this page. I am not going to pretend that question does not exist.
There is no single answer that fits everyone. It depends on how sensitive your data is and what you want to spend. Here are the three routes, with the downsides stated up front.
A provider from France or Germany, for example, processing inside the EU. Your text never leaves Europe from start to finish. For reading, summarising and sorting this is more than good enough. For the heaviest reasoning work it still trails the top of the market.
The best known models come from the United States. I only use them through a business account that states your text is not retained for training, with processing inside Europe where that is offered. If you say no to this route, I do not use it.
In your own server room, or with a host you pick. Nothing leaves your building. You pay for the machine and the upkeep, and a model like that is slower than the best online ones. For sensitive files that is usually worth it.
Whatever we pick, it goes on paper. The name of the provider, the country of processing and the terms are in your contract. If I want to change something later, because a better model turns up for instance, I ask you first. You do not hear about it afterwards.
The law is abstract and most privacy statements are too. This is what it looks like inside a project, in steps you can check.
You sign it before a single record is touched. The parties in the list above are named in it. If you would rather use your own template, I sign that, as long as it contains nothing I cannot deliver on.
I only pull what the process needs. An agent for your purchase invoices has no business reaching your HR files. Every connection gets the narrowest access that still does the job.
By default processed documents stay for 90 days so you can check what happened. After that they go. If it should be 7 days, or 7 years because of a statutory retention period, that is how I set it.
Me, with two-factor authentication, and the systems that do the work. There is no team of onlookers behind me. Every time a person or a process reaches production, it is in the log.
If what I build holds personal data, the button to find it and wipe it is built in from the start. When one of your customers asks, you handle it yourself without calling me.
The GDPR asks non-EU companies with customers here to appoint a representative in the EU under Article 27. That is a legal appointment, so I point you to a party that takes that role on. What I do handle is the technical half: EU regions, a processing agreement with named sub-processors, and records you can hand to a supervisory authority.
With a data breach you hear from me within 24 hours, with what happened and which data it touches. You file it with your supervisory authority within 72 hours, and I supply everything you need for that.
The law has been in force since August 2024 and arrives in pieces. For most small and mid-sized companies it is lighter than the headlines suggest. What I build almost always sits in the light category, with a few things you simply have to arrange.
A handful of uses are no longer allowed, such as scoring people on social behaviour. On top of that, staff who work with AI have to understand enough about it. At most companies that last part is a half-hour explanation.
The companies behind the large models have to document how their model is built and what it was trained on. That is useful for you: the information becomes available on request and it helps fill your own file.
High-risk systems, in recruitment or credit scoring for example, get heavy requirements. Anyone talking to an AI also has to be able to tell that it is an AI. If you work in one of those corners, we start there.
AI sitting inside a product that already goes through other certification, such as machinery or medical devices, follows last. If you build products like that, this belongs in your design work from now on.
What I do as standard, whichever category you fall into. For every system I write down what it does, what goes into it and who is accountable, so you have a file before anyone asks for one. Where a decision touches money or people, a human signs off. Every action lands in a log, so afterwards you can see why something happened. And if one of your customers talks to an agent, it says that it is an agent.
Stricter is almost always more expensive or slower. So you choose, and I tell you what it costs. All three work, including if you want to move over later.
Everything runs with the parties in the list, on servers in Frankfurt, Amsterdam and Dublin. Quick to set up and reasonably priced. For most companies this is the right call, and you can always move off it.
Then I look for a European company for every part, so no US parent anywhere in the chain. It takes more setup work and a few handy services drop out. In government and healthcare this tends to clear review more easily.
In your own server room or with a host you choose. Nothing goes out, the model included. You pay for the machine and the upkeep, and you give up some speed. For genuinely sensitive files this is the way.
Torn between the three? In the AI Process Audit I work out the difference in euros per month, and write down which risk the more expensive option actually buys off. Then you decide for yourself whether that is worth it.
This is where working relationships get stuck. So it is fixed up front, not at the moment you want to leave. You do not have to ask me for permission for any of it.
You pay for the hosting and the database yourself, on accounts that belong to you. I work inside them as an administrator for as long as we work together. If it ends, you remove my access and everything keeps running.
Within ten working days I deliver an export of your database in a plainly readable format, plus the source code and the notes on how it runs. Enough to carry on yourself, or to hand to someone else.
Within 30 days of the end everything on my side is gone. The automatic backups roll off after that, 90 days at the outside. You get written confirmation with the date on it.
In between as well. You can ask at any moment what I hold of yours and where it sits. You get that list within five working days. The right is in the processing agreement, so it does not depend on my calendar.
A page about security that only carries good news is not an honest page. These are the things you get at a large agency and do not get from me yet.
Whatever you have built and however strictly you set it up, these are fixed.
Feel free to forward this page. The answers below are written for someone who has to assess this for a living.
At a large agency you get a certificate and a department that owns it. With me you get this page and my email address. I build it, I run it, and if something goes wrong I am the one you get hold of.
I am strict about your data staying in Europe and about the thing still working six months in. If something here looks wrong to you, mail me at info@diginesso.com. Then I either fix it or explain why it reads the way it does.
Wesley Beerendonk · Diginesso
Want your own IT lead to go over this? Send them this page, it is written for them.
Digi, my AI colleague, walks you through where it pinches in a few minutes. After that I read it myself and get in touch personally.
Talk to Digi about your process. A few questions, and you know where the gain sits and how it gets set up safely.
Talk to DigiFree and no strings attached. I use your details only to answer you.