Where your documents go, and where they do not.
The answer for your compliance team, written by the people who built the system. The data processing agreement and the list of our providers are available on request.
In short
Your documents and results are stored in Frankfurt. The AI models run only at EU endpoints that keep nothing (zero data retention): every request forbids the provider to store it or to train on it, and a request that cannot be served that way fails instead of going elsewhere. Some of our providers are US companies (Cloudflare, Supabase, OpenRouter); they are bound by the EU's standard contractual clauses or the EU–US Data Privacy Framework.
Khumo staff see a project only if your organisation adds them, and your admins see who is a member. Access to our servers is limited to named administrators. Support works from logs and error messages, not from your documents.
How a project keeps its documents
| Mode | Documents | Results | AI models |
|---|---|---|---|
| Keep documents (default) | Stored in Frankfurt, one folder per project; deleted with the project, backups included | Database in Frankfurt; deleted with the project | EU endpoints, zero data retention |
| Delete after each check | Deleted with their full text once a check has read them, also from the backup | Kept: the results with the passages they cite, document names and summaries | EU endpoints, zero data retention |
| Your own cloud (on request) | Your storage | Your database | Agreed with you |
What we put in writing
- A data processing agreement under the GDPR, with retention and deletion periods
- The list of our providers: Koyeb (servers, Frankfurt), Supabase (database and sign-in, Frankfurt), Cloudflare (delivery of the app, network), OpenRouter (routing to the AI models) with the models' EU hosts, and Brevo (e-mail)
- The technical and organisational measures, described from how the platform actually works
- Deletion on request, confirmed in writing, for documents, results and everything else in a project
- An audit log per organisation of who uploaded, ran, corrected or approved what, and when
Tenant separation
Every organisation is separate: its members see only its projects. People from your client's side are invited to a single project and see only what you open for them. Every request is checked on the server, closed unless opened.