We help you handle compliance. Here is how we handle our own.

The platform runs on Google Cloud in three EEA regions, and its interface is delivered from edge servers in the European Economic Area (EEA), geo-restricted to the EEA. Compute, storage, AI analysis and disaster recovery all run in the EEA. Below are the regions, followed by every entity that processes data for us — legal name, country, role and processing region. Where a provider is a US company, its service for us is configured to process data in the EU; any residual support access is covered by the EU-U.S. Data Privacy Framework (listing verified on 10 October 2026) and by standard contractual clauses (Decision 2021/914).

• Changes are announced 30 days in advance. Before we add or replace a platform sub-processor, we e-mail your organisation's named contacts recorded at onboarding — your account administrators — and update this list. You can object on data protection grounds within the window set out in the data processing agreement.
• Only the first five entities receive data from the platform. The website and business providers process data for which DeepTech itself is the controller and never receive your documents.
• Components we run ourselves inside our cloud tenancy — the database, the vector index, the cache and the job queue — are part of the platform, not separate sub-processors.

The full sub-processor list gives each entity's address, the categories of data it processes and the legal safeguards behind it.

Customer documents are encrypted in transit (TLS 1.3, with TLS 1.2 as the minimum version) and at rest (AES-256, customer-managed keys in Cloud KMS, rotated every 90 days). Two independent layers separate one organisation's data from another's: role-based permissions in the application (RBAC) and row-level security in the database. That design makes access to another organisation's data structurally impossible.

• A single deletion process covers the vector index, the relational database and object storage, and the requester receives confirmation.
• Backups allow point-in-time recovery, are encrypted and stay in the EEA. Deleted data ages out of the backups within 7 days.
• Every user action, AI assessment and human override of an assessment goes into an append-only log. A cryptographic hash chain makes any change to its history detectable.

Retention of documents, reports and logs held for you in the platform is set by the data processing agreement and described in the data retention and deletion policy.

Audomate uses retrieval-augmented generation (RAG) inside a verification framework: every generated finding and document is grounded in the actual regulation and your actual evidence, carries source references and a confidence indicator, and anything the model cannot ground is marked for review rather than stated as fact. The person responsible for compliance reviews, edits or overrides every assessment. We record who decided, when and why. The AI proposes; your team decides.

• The models run through the OpenAI API with EU data residency (OpenAI Ireland Ltd), under Zero Data Retention: the model provider does not store prompts or responses. They are never used to train models — not by us and not by the provider.
• Each organisation's audit session is fully isolated. Its context stays in working memory only until the session ends.
• Before any content reaches the model, an input gateway detects prompt injection attempts and sanitises the input.
• Every organisation has a token usage limit and receives alerts on consumption. That keeps the scale of processing under control.
• Organisations that need full independence from external model providers can deploy their own way: an on-premise LLM stack, a portable hardware box or a white-label instance, alongside the standard EU SaaS.
• We have carried out a data protection impact assessment (art. 35 GDPR) for the AI contract-audit module. It was prepared in October 2026 and is being signed off by the CTO, the CEO and the Data Protection Coordinator; a summary is available to support your own assessment.

Details are in the AI & Data Governance Statement.

• Your organisation is the controller of the personal data in the documents it uploads and of its users' accounts. DeepTech sp. z o.o. processes that data as a processor (art. 28 GDPR), only on your documented instructions.
• DeepTech is the controller of the data it needs to run its own business — website visits, enquiries, contracts and invoices, recruitment. The Privacy & Cookie Policy describes that processing.
• The Terms of Service are the agreement. Audomate is sold to businesses only. Accepting the Terms of Service concludes the agreement, and the data processing agreement (DPA) is provided when the account is created, with annexes describing the technical and organisational measures and the sub-processors in section 01. Both documents have been with an external law firm for review since 10 October 2026; until they are published, every deployment runs under a signed agreement and DPA.
• We inform affected customers of personal data breaches without undue delay, within 24 hours at the latest. Notification to the supervisory authority (PUODO) follows within 72 hours where art. 33 GDPR requires it.
• The platform supports data subject rights: access, rectification, erasure and restriction of processing. That includes permanent deletion across every storage layer.
• We keep a record of processing activities (art. 30 GDPR). It is made available to the supervisory authority on request and to auditors; it is not published.

Privacy questions and data subject requests: privacy@audomate.eu. Privacy matters are coordinated by our Data Protection Coordinator, Kacper Raubo, a member of the Management Board. As a micro-enterprise we are not required to appoint a Data Protection Officer under art. 37 GDPR and have not done so.

If your organisation is subject to DORA, you will list us in your register of information as an ICT third-party service provider. We have prepared the data and documents needed to assess us. The full pack is available on request — it contains the information below in a form ready to use in the register.

• Incident notification — we inform your named contacts of critical incidents affecting your organisation within 30 minutes on the Enterprise plan, or 24 hours on the Standard and Pro plans. A written report follows within 24 hours.
• Audit and access rights — the contract gives you and the competent supervisory authorities audit, information and access rights in line with Art. 30(3) DORA.
• Termination — we provide a full data export in open formats (PDF, DOCX, CSV, JSON), confirmed permanent deletion, and transition assistance for 30 days after the contract ends.
• Business continuity — infrastructure in two regions, automatic failover and documented RTO/RPO per plan (section 01). The business continuity and disaster recovery summary is available on request.

We distinguish our infrastructure provider's certifications from our own organisation's. The infrastructure layer relies on Google Cloud's certifications. Preparations for DeepTech's own certification are under way. When the report is available, we will publish it here.

Public documents open in full on this site, and each page is the same text as the document file — there is one version of each. They are version 1.2 of October 2026, awaiting formal adoption by DeepTech's Management Board. Internal procedures are shared with customers and auditors on request, some under an NDA.