Hosting
The application and the database run at Hetzner in Germany (Falkenstein). Document services run at Hetzner in Finland (Helsinki). Inbound traffic passes through Cloudflare. Cloudflare can process requests inside or outside the EU because the plan has no Data Localization Suite. The application database and all files sit in the EU.
AI inference
Today the default text inference runs at Anthropic (US) under the EU-US Data Privacy Framework and Standard Contractual Clauses; tenants on the EU region are served inside the EU, over Amazon Bedrock (endpoint Frankfurt; AWS may run the model in other EU regions) or OpenRouter's EU endpoint. Our rule is EU-first wherever there is a choice: all inference is moving to EU providers. If the EU path is unavailable the request fails instead of falling back to the US. No model provider trains on your data. The register shows which provider runs where.
Encryption and tenant separation
Content (email bodies, transcripts, drafts, OAuth tokens) is encrypted at rest with AES-256-GCM, with a separate key per tenant derived from a master key held outside the database. Every row of tenant data carries its tenant, and the database itself enforces the separation (row-level security), not only the application code. Transport is TLS only.
Retention and deletion
You can export or request erasure at any time. On erasure, content is removed and OAuth tokens are revoked immediately; the account is hard-deleted after 30 days. Financial records are kept for the statutory period.
No training on your data
Your data is not used to train any model, ours or a provider's. This is written into our DPA and applies to every provider we engage.
Certifications
We hold no ISO 27001 and no SOC 2 certification today, and we claim none. What we have: a GDPR setup with an Art. 28 DPA, a sub-processor register, an Art. 17 deletion path and an incident-notification process. We answer security questionnaires in writing.
Sub-processors
The same set as the machine-readable register the application serves itself. If this table and the register differ, the register wins. Open the register.
We engage
| Provider | Purpose | Location | DPA |
|---|---|---|---|
| Anthropic | AI text inference for non-EU-region accounts. This US path carries no tenant traffic once the deployment makes EU the default data region. EU-region accounts use OpenRouter EU or Amazon Bedrock in the EU. | US | in place via vendor terms |
| Nylas | Email and calendar broker for connected Google and Microsoft accounts; holds the OAuth grants. The DPA and transfer basis for backups outside the EU/EEA remain to be confirmed. | EU (Ireland); backups may be in the US, Canada, Australia and Brazil | pending, before launch |
| AWS (Amazon Bedrock, eu-central-1) | Memory embeddings in Frankfurt, until moved to OpenRouter EU. EU chat inference, or EU failover when OpenRouter is selected. Chat can run across AWS EU regions. Zero-retention posture remains to be confirmed. | EU (endpoint Frankfurt; other EU regions possible) | in place via vendor terms |
| Hetzner Cloud | Hosting of the application and the PostgreSQL database; the database and all files sit here, encrypted. | EU (Germany, Falkenstein; Finland, Helsinki for document services) | signed 2026-09-25 |
| Cloudflare | CDN, DDoS protection, web application firewall and TLS termination for random-assistant.com. | Global (inside or outside the EU; no Data Localization Suite) | in place via vendor terms |
| Stripe | Subscription billing and card payments. Card data is tokenised by Stripe; we never see the card number. | US | pending, before launch |
| Resend | Transactional email, signature notices to the tenant and signers (including the sealed signed PDF on completion), and workflow notification email that may contain processed email or document text. Workflow email is blocked for tenants with EU data residency. | US | pending, before launch |
| OpenRouter | Chat and background AI tasks for EU-region tenants through the EU endpoint when selected; all tenants once EU is the default data region. Requests are restricted to European data regions with data collection denied. Where switched on, Mistral AI (France, EU) serves email classification and voice dictation as the upstream provider, and Google serves memory embeddings in the EU. Other AI tasks use Anthropic Claude. EU routing is a per-request control, not a contractual EU-only commitment. | EU (eu.openrouter.ai; OpenRouter, Inc. is a US company) | in place via vendor terms |
| Gladia | Speech-to-text for voice dictation, and for meeting recordings when meeting recording is on. The default dictation provider and the only meeting transcription provider. | EU (France) | pending, before launch |
| Sentry | Error monitoring for the backend and the web app. Payloads are allow-list scrubbed before they leave our servers. | EU (Germany) | in place via vendor terms |
| PostHog | Product analytics for the web app and page counts on the landing, cookieless, in-memory only. No advertising, no cross-site tracking. | Web app and landing: PostHog EU Cloud (Germany). Backend: US host unless the EU region is configured | signed 2026-09-26 |
You connect (your own contract with the provider)
| Provider | Purpose | Location | DPA |
|---|---|---|---|
| Google (Workspace APIs) | Gmail, Calendar and Tasks: read, and create drafts and tasks on your instruction. | EU/US | your own contract |
| Microsoft (Outlook / Calendar) | Outlook mail and Microsoft Calendar, brokered through Nylas. | EU/US (per your Microsoft 365 tenant region) | your own contract |
| HubSpot | CRM contacts and deals: read, and create notes and tasks on your instruction. | EU/US (per your HubSpot account data region) | your own contract |
| Pipedrive | CRM contacts, deals and activities: read, and write notes and tasks on your instruction. | EU/US (per your Pipedrive account region) | your own contract |
| Attio | CRM contacts, companies and deals: read, and write records and notes on your instruction. | EU/US (per your Attio account) | your own contract |
| RecruitCRM | Recruiting CRM: candidate, job and pipeline data, read on your instruction. | US / global (per your RecruitCRM account) | your own contract |
| Amplemarket | Sales engagement: prospect records and email-sequence data, read on your instruction. | US / EU (per your Amplemarket account) | your own contract |
| Notion | Page and document content from your Notion workspace, read on your instruction. | US (Notion Labs, Inc.) | your own contract |
| Slack | Messages and channel metadata from your Slack workspace, read on your instruction. | US (EU data residency available from Slack) | your own contract |
| Motion | Tasks and calendar events from your Motion account, read on your instruction. | US | your own contract |
| Gamma | Presentation content in your Gamma account, generated and read on your instruction. | US | your own contract |
| Kickscale | Meeting transcription provider. We parse the summary emails you forward; we do not call a Kickscale API. | EU (Austria) | your own contract |
DPA on request
Our data processing agreement under Art. 28 GDPR is online. A countersigned copy is available on request at privacy@random-assistant.com. Read the DPA.
Privacy contact
The controller is Random Solutions s.r.o., Brno (Czech Republic), see the imprint. We have not appointed a data protection officer; under Art. 37 GDPR one is not required for us. Privacy requests: privacy@random-assistant.com. Security reports: security@random-assistant.com.