What your DPO will ask, answered here
Trust: where your data lives and what we keep
One page for the security and data protection review: what leaves, what is kept, where and with whom. If something is missing, write to us and we will add it.
Updated
What we keep and what we do not
- Accounts, teams and roles
- Data policies and spend caps
- A log of every request: who, team, model, detected categories, action and cost
- Provider keys, encrypted
- Policy and permission changes
- The text of messages
- The model's responses
- Attachments
- The real values detected (they stay on the device)
Who takes part
Processors we use to provide the service. List current as of 17 October 2026; we will give notice before adding a new one.
| Provider | Purpose | Where |
|---|---|---|
| Supabase | Accounts, policies, evidence log and server functions | Project in an EU region |
| Vercel | acotia.com website and contact form | Global network; form in Paris (EU) |
| Cloudflare | DNS for the acotia.com domain | US company |
| Sentry | Anonymous error reports from the app and Ops: error type and version, no chats, files, memory or personal data; can be turned off in Settings | Project in an EU region |
| Resend | Sending and receiving email for hola@acotia.com | US company |
Models (OpenAI, Anthropic, Google, Mistral) are contracted by your company with its own account and keys: they receive the request already masked, and Mistral offers EU-hosted models.
Compliance status
What we have today, what is planned and what is not. Position as of 14 October 2026; we show no badge we do not hold.
| Framework or control | Status | What it means |
|---|---|---|
| GDPR: data processing agreement (DPA) | Available on request | Acotia acts as data processor; the list of processors is the one above. |
| Evidence log | Included in the product | Every request is logged without content and exported as CSV. |
| External penetration test | Planned | Before the first large sale. We will publish the date and scope. |
| ISO 27001 and ENS | Planned, not certified | It is a multi-month route; today we hold neither. |
| AI Act (deploying company) | Partial | The log helps document use; specific documentation is planned. |
| SOC 2 | Not planned | We will consider it if we have customers outside Spain. |
If your security review needs something that is not here, tell us before the pilot.
Built to pass the IT and DPO review
Where it runs, what it keeps, which model accounts it uses and who can change what. What they usually ask, at a glance.
Where it runs
A desktop app for each person and a gateway on the server. Accounts, policies and the log live in the EU.
What is kept
Metadata for each request: who, team, model, categories, action and cost. Not the text: conversations are stored encrypted on the device.
Your model accounts
The company connects its own OpenAI, Anthropic, Google or Mistral accounts. Keys are encrypted and never return to the browser.
Access and changes
Sign-in with Google or Microsoft, three roles (super admin, admin and employee) and a log of every policy or permission change.
Four places, four rules
- 01
On the device
Conversations, encrypted, and the real values that were masked.
- 02
On the server, in the EU
Accounts, policies and the log of each request, without the text.
- 03
Model hosted in the EU
Receives whatever the policy marks as delicate.
- 04
External provider
Only receives sanitised text, with labels instead of data.
What it protects and what it does not
Acotia prevents accidental leaks and keeps a record of every request. There are two folders: the work folder, for everyday use, and the sensitive folder, whose policy the company sets: mask, send only to an EU model, or let nothing out. With «let nothing out», the app does not even read those files for the chat. A chat that has been sensitive stays sensitive, on the server too, and the «treat everything as sensitive» option applies that policy to every request regardless of what each device declares. What no tool can prevent is someone with access to a document deliberately copying it somewhere else: your company's permissions decide that, and Acotia gives you the record.
Encryption of provider keys
The OpenAI, Anthropic, Google or Mistral keys your company connects are encrypted with AES-256-GCM before being stored and never return to the browser: the dashboard only shows the last four characters. Only a company admin can set, test or delete them.
Retention and deletion
The company decides how long the evidence log is kept (between 30 days and 10 years; one year by default) and whether conversations on the device are deleted automatically after a period. For any access or erasure request, write to hola@acotia.com.
Certifications
We do not yet hold certifications such as ISO 27001 or SOC 2, and we would rather say so. What we can show you in the review is the architecture, the log of a real request and the default policies. More in security and evidence log.
Data processing agreement (DPA)
If your company needs a data processing agreement under Article 28 GDPR, request it at hola@acotia.com with your company's legal name. We review it with your legal team before the pilot.
Official sources
General Data Protection Regulation (GDPR), Regulation (EU) 2016/679: official text on EUR-Lex.
The processor and the contract that governs it are set out in Article 28 of the GDPR.
Frequently asked questions
Does Acotia read my team's conversations?
No. To reach the model, the already masked text passes through the gateway, which checks it again and does not store it. What stays on the server is metadata for each request; the text of messages and responses is stored encrypted on each person's device.
Does anyone else see the text of the messages?
Only the AI provider your company chooses, with sensitive data already hidden or blocked according to your policy. Acotia does not store it and cannot read it.
Which AI providers receive our data?
The ones your company connects with its own account (OpenAI, Anthropic, Google or Mistral), and always after masking or blocking whatever the policy says.
Do you have ISO 27001 or SOC 2?
Not yet. In the security review we show you the architecture, the default policies and the log of a real request.
Can someone get around the sensitive folder?
Not by accident: the policy is applied on the device and again on the server, and a sensitive chat cannot go back to being a work chat. If your company needs the full guarantee, turn on «treat everything as sensitive» and the server applies it to every request. Someone who wants to take a document out on purpose can copy it outside Acotia: that is what your company's access permissions are for.