Security and data protection

Clear commitments for your data.

This page summarizes how we handle client data. The binding document is the data processing agreement we sign before we first process personal data on your behalf in a project. It names the services that process that data.

Request the DPA draft →

In short

Our standard commitments

EU processing by default

Client data is processed on EU infrastructure by default. Where a project requires it, we run the system on the client's own servers.

No training by the model services used

The model services used in a project are configured and contractually bound so that client data is not used to train AI models. This commitment applies to the booked service and its configuration. The DPA names the providers used in your project. In typical EU projects we use the models through AWS Bedrock and Azure OpenAI in EU regions.

Human sign-off

Messages to customers and actions on client data need a sign-off by your team by default.

A DPA before the first data access

Where we process personal data on your behalf in a project, the data processing agreement comes with the proposal and is signed before we first access that data. We process that data only on your documented instructions.

Professional secrecy

For tax and law firms we also take on the duties of the professional laws that apply to the project, such as § 62a StBerG and § 43e BRAO in Germany or § 80 WTBG in Austria, and bind subcontractors identically.

Providers

Examples from typical EU projects

This list is not complete. The DPA names the subprocessors in your project, for example also a telephony provider for a phone assistant. We announce changes in advance, with a right to object.

ProviderPurposeLocation and transfers
AWS BedrockAccess to language modelsEU regions
Azure OpenAI (Microsoft)Access to language modelsEU regions

For running our company and this website

Legal bases and transfers are explained in our privacy policy.

ProviderPurposeLocation and transfers
HetznerHosting of the website, our CRM (Twenty) and analytics (Plausible)Germany
CloudflareWebsite delivery and protection against attacksUSA, EU standard contractual clauses and Data Privacy Framework
Google WorkspaceEmail, calendar and video callsContracting entity Google Cloud EMEA (Ireland). Processing may also take place outside the EU, transfer bases in the privacy policy
BrevoInternal notifications about contact enquiriesSee the privacy policy
Cal.comAppointment bookingUSA, EU standard contractual clauses

Technical and organizational measures

Encryption in transit and at rest.
Access on a need-to-know basis only.
Logging of processing.
Separate environments per client.
A confidentiality obligation for everyone involved in processing.
Support with data subject rights, data protection impact assessments and breach notifications without undue delay.

After the engagement ends, we delete or return the personal data processed on your behalf, at your choice and with confirmation, unless a statutory retention duty applies. The specific measures are an annex to the DPA. Your audit rights apply to the statutory extent.

What we deliberately do not claim

We do not claim across the board that no data leaves the EU. The DPA names the providers that process data in your project.
"No training" applies to the service booked and its configuration, not to every tool your team uses on its own.
We share contracts, security measures in detail and architecture during the proposal process, not publicly.

Found a vulnerability?

Please report it to office@modernagents.ai. Our contact details for security reports are also available in machine-readable form in our security.txt.

Your data protection officer has questions?

We send the DPA draft with the security measures and the list of subprocessors, usually within one working day.