Trust & Security
How Docent handles your data — what we store, where we store it, who can see it, and the standards we follow.
cloudsecurityalliance.org/star/registry/docent/services/docent-digital
Where your data lives
Storage is in Helsinki, Finland. Uploaded documents, the database, search vectors and backups are held on dedicated servers at Hetzner Online GmbH. This is where your data sits at rest.
An EU provider is available on request. Processing is inside the EU either way, but Google is a US company and therefore reachable under the CLOUD Act. An organisation that needs the provider itself to be under EU jurisdiction can switch its answers to Mistral, in France, from its own settings. Two things that switch does not change, stated plainly: search indexing still uses Google's embedding models in EU regions, because changing that would mean re-indexing every document; and storage stays in Helsinki.
AI processing is in the EU. Model calls go to Google
Vertex AI, in the EU multi-region or europe-west4
(Eemshaven, Netherlands) — never the global endpoint, which carries no
residency guarantee. Google Cloud's EU Data Boundary commitment confines
that processing to EEA regions.
Connected systems stay yours. Where you connect SharePoint, OneDrive, Confluence, Nextcloud, Google Drive, Notion or Slack, the original files stay where they are. Docent holds the extracted text, search vectors and the link needed to cite the document — not a copy of the file. Those connections are read-only: nothing in your systems is changed. Microsoft and Atlassian are not sub-processors of Docent in this arrangement; they are your own systems, under your own agreements, reached with an approval your administrator grants and can withdraw at any time.
Your access rules travel with the documents. A SharePoint library or a Confluence space can be synced with its own permissions, so someone who cannot open a file there does not receive it in an answer either — administrators included. Where the permissions cannot be resolved to people, the document is withheld from answers rather than guessed at.
Stored data does not leave the European Economic Area. US companies in the table below: Google (language model and embeddings in EU regions, and reCAPTCHA on sign-in), Sentry (error reports without request content, EU region), Stripe (billing only) and Cloudflare, which serves the marketing website only. The application at app.docent.digital is served directly from Helsinki, so Cloudflare never sees documents, questions or answers.
AI & model training
Your data is never used to train AI models. Docent uses Google Cloud Vertex AI as its model provider. Under Google Cloud's Cloud Data Processing Addendum and the AI/ML Privacy Commitment, prompts and responses are not retained by default and are not used to train or improve any model.
This is enforceable as a processor obligation under Article 28(3) GDPR.
EU AI Act position
Docent is classified as Minimal Risk under Regulation (EU) 2024/1689 (the EU AI Act). A B2B knowledge-management and document Q&A tool does not appear in any Annex III high-risk category, and Docent triggers none of the Article 5 prohibited practices.
What applies to Docent and how we comply:
| Provision | In force | Our status |
|---|---|---|
| Article 4 — AI literacy | Feb 2025 | Covered: our own product helps customers do this |
| Article 50(1) — Chatbot disclosure | Aug 2026 | B2B "obvious to a reasonably informed user" exception applies |
| Article 50(2) — AI-generated content marking | In force Aug 2026 | Signatory to the Commission's adequate Code of Practice (recognised compliance pathway); AI outputs carry machine-readable transparency metadata |
| Annex III high-risk obligations | — | Not triggered (knowledge management is not listed) |
| Article 22 GDPR — automated decisions | — | Not triggered (no decisions producing legal effects on individuals) |
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting, database, document and vector storage, backups | Helsinki, Finland |
| Google Cloud Platform | Vertex AI (Gemini) — model inference and embeddings | EU multi-region / europe-west4 (Netherlands) |
| Cloudflare, Inc. | DNS for our domains, and TLS and denial-of-service protection for the marketing website docent.digital only. The application (app.docent.digital) is not routed through Cloudflare, so no customer documents, questions or answers pass through it; content is not stored. | United States (network: nearest data centre, normally in the EU/EEA) |
| Google (reCAPTCHA Enterprise) | Bot protection on the sign-in and sign-up forms: IP address and browser signals, never passwords or document content. | Google infrastructure (US parent) |
| Sentry (Functional Software, Inc.) | Error monitoring. Technical error reports; request bodies, cookies and personal data are not sent. | Germany (EU data region); US company |
| Brevo (Sendinblue SAS) | Transactional email (password resets, notifications) from [email protected]. No document content is sent by email. | France (EU hosting) |
| Stripe | Payments and billing. Subscription and billing details only; no document data. | United States / Ireland |
Material changes to this list will be communicated by email and updated here before any new sub-processor begins handling customer data.
Transfers to providers based in the United States or with a US parent rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. Cloudflare carries only the marketing website. Brevo, Stripe, reCAPTCHA and Sentry receive no customer documents, extracted text or search vectors.
Standards & attestations
Items marked Under review or In progress are active applications. Updated when issued.
Security controls
| Area | Control |
|---|---|
| Encryption at rest | AES-256, managed by Google Cloud |
| Encryption in transit | TLS 1.3 |
| Authentication | HttpOnly + Secure cookies, short-lived JWTs (1 hour), server-side session revocation |
| Password policy | Minimum 10 characters, mixed case + digit |
| Access control | Role-based: company admin, department lead, employee |
| Audit logs | All access, document, and administrative actions logged with IP + user agent |
| Rate limiting | Per-IP limits on auth endpoints, configurable per route |
| Content Security Policy | Strict CSP with explicit allowlist of trusted sources |
| File upload validation | MIME type + magic byte validation, size caps |
GDPR rights & data subject requests
Customers and their end users can exercise GDPR rights (access, rectification, erasure, portability, restriction, objection) via Docent's built-in DPO dashboard or by contacting [email protected]. We respond within 30 days as required by Articles 12–22 GDPR.
For breach notification: under Article 33 GDPR, we notify affected customers without undue delay and within 72 hours of becoming aware of a personal data breach.
Documents available on request
- Data Processing Agreement (DPA)
- Records of Processing Activities (ROPA) — summary
- Data Protection Impact Assessment (DPIA) — summary
- EU AI Act classification memo
- Schrems II Transfer Impact Assessment (TIA)
- Sub-processor list (full)
Email [email protected] to request any of the above.
Contact
Data protection & privacy
Security disclosures
Legal & document requests