Trust Center

Security & compliance

Optimaite is hosted in the EU, is GDPR-compliant and protects your data with industry-leading security measures. Transparency matters to us.

Security measures Request a demo

GermanyHosting

AES-256Encryption

GDPRCompliant

No trainingon your data

Compliance

What we commit to, contractually and operationally

Our platform meets the strict requirements of European data protection and security standards.

GDPR

Full compliance with the European General Data Protection Regulation. Data processing agreement, TOMs and subprocessor register available.

Compliant

EU hosting

All application data is processed and stored exclusively in the EU. Infrastructure on Hetzner Cloud in Germany.

Germany

No AI training

Your data is never used to train AI models. All AI processing happens exclusively inside the EU via Azure AI (Germany) and AWS (Frankfurt) under zero-retention agreements.

Guaranteed

TOMs

Security measures

Technical and organisational measures that protect your data.

All 39 controls

Infrastructure

12 controls

Encryption in transit (TLS 1.3) and at rest (AES-256)
Kubernetes cluster with network segmentation
Automated backups with point-in-time recovery

Show all

Access control

8 controls

Multi-tenant isolation at the database layer
JWT-based authentication with tenant scoping
Role-based access control (RBAC)

Show all

Data protection

10 controls

Data processing exclusively inside the EU
Automatic data deletion at end of contract
Data classification and retention policies

Show all

Organisation

9 controls

Regular security training for every employee
Incident response plan documented and tested
Confidentiality agreements with every employee

Show all

Data

Data processing

How your data flows through our platform and where it is processed.

Infrastructure

Kubernetes cluster
Hetzner Cloud, Falkenstein/Nuremberg, DE
Database
Self-hosted PostgreSQL (CloudNativePG), Hetzner, DE
Object storage
Hetzner S3-compatible, Falkenstein, DE
Website & edge
Vercel, EU regions

Data we process

Name & email address
User accounts & authentication
Documents & files
Document processing, AI analysis
Chat messages
AI assistance & communication
IP addresses & metadata
Security logging & error diagnosis

Subprocessors

Hetzner Cloud

Infrastructure & storage · Germany

Zilliz Cloud

Vector database (embeddings) · EU (Frankfurt)

Azure AI Foundry

AI provider (GPT, Gemini) · EU (Germany)

AWS Bedrock

AI provider (Claude) · EU (Frankfurt)

Google Cloud

Vertex AI & speech-to-text · EU

Vercel

Website hosting · EU regions

Stripe

Payment processing · Ireland, EU

Mailgun

Transactional email · EU

Sentry

Error monitoring · EU

LangSmith

AI observability · EU

The AI services process document content in EU data centres under zero-retention terms: inputs are discarded after processing and never used for training. Customers can supply their own API keys and control the processing chain themselves.

Documents