Data protection · Professional secrecy
Before an agent sees your data, it is settled who sees what.
This page sets out what we commit to in every project and what we have implemented in the trades case study. We only state what is documented.
As of 24 October 2026
Commitments in every project
The contract first, then the data.
Data processing agreement before any data access
Before we work with personal data, we conclude a data processing agreement under Art. 28 GDPR. It lists every subprocessor with its service and place of processing. We announce changes in advance.
Secrecy under § 203 of the German Criminal Code
If you work as a tax adviser, lawyer or in another profession bound by secrecy, we and every person involved commit to confidentiality under § 203(4) StGB before the first data access.
You decide, we act on instruction
You set what the agent may read and do. The data processing agreement names who may give instructions in the project.
No legal advice
Whether processing is lawful is for you as the controller to decide, with your data protection officer if needed. We provide the technical details for it.
Trades case study
What it looks like in a running project.
A heating and plumbing company in Bavaria with 15 employees. The agent answers questions from the ERP and prepares quotes.
Where the data is
The company's server
ERP, automations and agent run on a server at Hostinger in its Frankfurt data centre. The host's data processing agreement applies as part of its terms of service.
Knowledge base
The agent's knowledge base is hosted by Supabase in the Stockholm region, inside the EU. Supabase offers its own data processing agreement, its acceptance is not yet documented.
Language model
The language model is provided by Mistral AI, a company based in Paris. Use of the data for training the model is switched off. Acceptance of Mistral's data processing agreement is not yet documented.
Operating channel
The agent is operated via Telegram. Telegram does not offer a data processing agreement. This risk is assessed in the data protection impact assessment.
What the agent may do
- It has its own read account in the ERP. What it does not need is locked on that account, not just by an instruction in the prompt, for example bank details and VAT ID.
- It creates new contacts, leads and products only after a person confirms. It writes internal notes on instruction, marked as AI notes.
- It does not write to customers or suppliers and sends no emails.
- Every write action is logged outside the agent, rejected ones included. Its read access to the ERP is recorded in a separate log. An emergency stop halts it at once.
- It identifies itself as AI, as Art. 50 of the EU AI Act requires.
Documents we prepared
- Data protection impact assessment
- Addendum to the record of processing activities
- Addendum to the GoBD process documentation
- AI fact sheet with purpose, model, tools and limits
- Information for employees
- AI literacy training material under Art. 4 of the EU AI Act
The company approves the documents, because it is the controller. What your project needs, we clarify in the process check.
For tax firms
The knowledge belongs to the firm.
- The firm brain is stored separately from the AI model. The model can be replaced, the knowledge stays with the firm.
- Where the agent is unsure, a professional decides. Every step is logged, as the GoBD require.
- Reviewed receipts go to DATEV. We complement DATEV, we do not replace it.
Enquiries via this website
How we process your enquiry via the contact form is described in the privacy policy.
Questions about data protection in your project?
We go through them in the initial call, before any access is set up.
Book an initial call