Data Processing Terms
Schedule 1 of our Terms of Service: roles, processing details, security, subprocessors, deletion and international transfers. It applies to every customer.
Security and compliance
Trust center
How Typewise protects your data: certifications, subprocessors, hosting, and the documents your security and legal teams ask for.
ISO 27001
Certified
GDPR
Compliant
EU Only
Data Hosting on AWS
0 Data
Used for External AI Training
Documents
What your security and legal teams will ask for, in one place. Each entry names the version it refers to, so you know what you are reading.
Read the terms
Subprocessor list
Every third party that processes customer data on our behalf, with the processing location and how long data is kept.
Privacy Policy
How Typewise AG handles personal data under the GDPR and the Swiss Federal Act on Data Protection, including the data protection contact.
Signed Data Processing Agreement
Customers who need a separately signed DPA in addition to the Data Processing Terms can request one.
Subprocessors
Every third party that processes customer data on our behalf, and where. 3 of the 8 are AI model providers. They process prompts in the European Union with zero data retention: nothing is stored at rest by the provider.
| Provider | Processing location | Purpose | Data handling |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Germany (Frankfurt) | Platform hosting, database, knowledge sources, and Typewise-hosted Sentry error logging. | Platform data is retained for the Services and deleted within 30 days after termination; error logs are deleted within 30 days. |
| Microsoft Switzerland GmbH | European Union | AI model inference through Azure OpenAI Service. | Prompts are processed in the EU with zero data retention and are not stored at rest by Microsoft. |
| OpenAI Ireland Ltd | European Union | AI model inference. | Prompts are processed in the EU with zero data retention and are not stored at rest by OpenAI. |
| Google Cloud EMEA Limited | European Union | AI model inference through Vertex AI. | Prompts are processed in the EU with zero data retention and are not stored at rest by Google. |
| LangChain, Inc. | Processing in the European Union; entity in the United States | AI-agent execution tracing and logging. | Prompt and response logs are retained for 14 days; sensitive values are minimized or masked where possible. |
| Ably Realtime Ltd | European Union; entity in the United Kingdom | Real-time chat updates. | Chat messages are transient and not stored after delivery. |
| PostHog, Inc. | Germany; account administration may involve the United States | Product analytics and masked session diagnostics. | No free-text Customer content is intended to be stored; masked session replays are deleted after 90 days. |
| Eleven Labs Inc. | European Union | Speech-to-text transcription. | Audio is sent to the configured EU endpoint for transcription; returned transcripts enter the Platform data flow. |
Mirrors Schedule 1 of the Terms of Service effective 1 October 2026. Additions and replacements are announced under the Terms, with 14 days to object.
Where your data lives
Hosted in Frankfurt, processed in the EU, governed by Swiss law. The short version of what the legal pages say about location and jurisdiction.
- Hosting
- All services run on Amazon Web Services in Frankfurt, Germany. Databases are encrypted at rest and all data in transit is encrypted with TLS.
- Customer data
- Customer data processed under our Data Processing Terms is processed in the European Union and/or Switzerland.
- AI inference
- Prompts go to the model providers in the subprocessor list and are processed in the European Union with zero data retention.
- Swiss company, Swiss law
- Typewise AG is based in Zurich. Our privacy policy is written for both the GDPR and the Swiss Federal Act on Data Protection (revDSG), and our Terms of Service are governed by Swiss law.
- Data protection contact
- Janis Berneker is our Data Protection Officer. Contact details are in the privacy policy.
Typewise Culture
Your data is never used to train our AI. This is our most important commitment. Typewise does not use your customer data to train AI models for other customers – ever.
No Cross-Customer Training
Your data stays within your own tenancy. We never pool customer data to improve base AI models used by others.
No Data Leakage
Conversations, tickets, and agent interactions are processed in isolation. Nothing flows between customer environments.
Your Model, Your Data
If you choose to fine-tune a model, it is trained exclusively on your data and deployed only within your environment.
We do not use your customer data to train AI models for other customers.
Flexible privacy models
Flexible privacy models that adapt to your security needs — from real-time processing with zero data retention to configurable PII masking before any data reaches the AI. Built for regulated, high-sensitivity environments.
Zero Data Retention
The AI processes requests in real time and stores nothing afterwards. Ideal for highly sensitive data environments.
PII Masking Available
Sensitive personal data (names, card numbers, IDs) can be automatically masked before the AI ever processes it.
People & Processes
Security is embedded across our people and processes — from ISO 27001-aligned programs and regular audits to clear roles, ongoing training, and annual penetration testing.
Information Security Program
Our program follows the criteria set forth by the ISO 27001 Framework ‒ a widely recognized international information security standard.
Third-Party Audits
Our organization undergoes independent third-party assessments to test our security and compliance controls on a regular basis.
Third-Party Penetration Testing
We perform an independent third-party penetration test at least annually to ensure that the security posture of our services is uncompromised.
Roles & Responsibilities
Roles and responsibilities related to the protection of customer data are well defined. All team members must review and accept all security policies.
Security Awareness Training
Team members go through employee security awareness training covering industry standard practices such as phishing and password management.
Confidentiality
All team members are required to sign and adhere to an industry standard confidentiality agreement prior to their first day of work.
Background Checks
We perform background checks on all new team members in accordance with local laws.
Infrastructure & Data
Our cloud infrastructure is built with security at its core — hosted on AWS, with EU data residency, end-to-end encryption, continuous monitoring, and robust backup and incident response processes.
Cloud Infrastructure
All of our services are hosted with Amazon Web Services (AWS), which employs a robust security program with multiple certifications.
Data Hosting ‒ EU Only
All of our data is hosted on AWS databases located in the European Union. Your data stays in the EU.
Encryption at Rest
All databases are encrypted at rest, ensuring your data is protected even in the event of unauthorized physical access.
Encryption in Transit
Our applications encrypt all data in transit using TLS/SSL only ‒ no unencrypted connections are permitted.
Vulnerability Scanning
We perform continuous vulnerability scanning and actively monitor for threats across our infrastructure.
Logging & Monitoring
We actively monitor and log various cloud services to detect and respond to anomalies in real time.
Business Continuity & Disaster Recovery
We use AWS backup services to reduce any risk of data loss, with monitoring services that alert the team immediately.
Incident Response
We have a process for handling information security events which includes escalation procedures, rapid mitigation, and communication.
Identity & Control
Access is tightly managed through least privilege, enforced multi-factor authentication, and continuous logging — ensuring only the right people have access, and every action is tracked.
Least Privilege Access
Access to production systems follows the principle of least privilege ‒ team members only have access to the systems and data they need.
Multi-Factor Authentication
Multi-factor authentication (MFA) is enforced for all internal systems and cloud infrastructure access.
Access Logging
All access to production environments is logged and monitored. Access logs are retained and reviewed regularly.
Access Reviews
We conduct regular access reviews to ensure that access rights remain appropriate and are revoked promptly when no longer needed.
Third-Party Oversight
We carefully vet all vendors, enforce GDPR-compliant agreements, and continuously monitor their security — ensuring third parties meet the same standards we hold ourselves to.
Vendor Risk Assessment
All third-party vendors are assessed for security and compliance before being onboarded. We evaluate their security posture and certifications.
Data Processing Agreements
We maintain Data Processing Agreements (DPAs) with all vendors who process personal data on our behalf, in accordance with GDPR.
Ongoing Monitoring
Vendor relationships are reviewed on a regular basis to ensure continued compliance with our security and privacy standards.
Your internal compliance check
Regulated buyers run every AI vendor through an internal checklist before a pilot. Here is what we can hand you for each step.
Data protection check (GDPR / DSGVO)
Data Processing Terms, the subprocessor list with processing locations, the privacy policy, and a signed DPA on request.
DocumentsSecurity questionnaire
Send us yours. We answer from the controls described on this page: ISO 27001, encryption, access control, logging, backups and incident response.
Send a questionnaireCertification and testing
ISO 27001 certified, independent third party audits, and at least one independent penetration test every year.
People and processesEU AI Act check
The AI Supervisor Engine hands a conversation to a person when the request calls for it, a review agent checks outgoing responses before they are sent, and every action is logged. Our checklist walks through the obligations that apply to customer support from August 2026.
EU AI Act checklist
Frequently Asked Questions
The AI only processes the data necessary to generate a response or perform an action. For highly sensitive environments, we offer PII Masking, which can automatically mask sensitive data such as credit card numbers before the AI ever processes it. We also offer a Zero Data Retention model where nothing is stored after processing.
That is not a problem. All of our data is hosted on Amazon Web Services (AWS) databases located exclusively in the European Union. Your data stays in the EU.
Our infrastructure is highly secure. We use AWS, which employs a robust security program with multiple certifications. All databases are encrypted at rest, and all data in transit is encrypted using TLS/SSL. We also perform continuous vulnerability scanning and annual independent penetration testing.
No, never. This is our core promise. We do not use your customer data to train AI models for other customers. Your data stays within your own tenancy, and there is no cross customer training or data leakage.
Typewise is ISO 27001 certified, which is a widely recognized international information security standard. We are also 100% GDPR compliant and ready for the EU AI Act.
All of our services and data are hosted with Amazon Web Services (AWS).
Prompts are processed by Microsoft (Azure OpenAI Service), OpenAI and Google (Vertex AI) in the European Union with zero data retention: the providers do not store prompts at rest. The full list, including hosting and tooling providers, is in the subprocessor table on this page and in Schedule 1 of our Terms of Service.
Yes. Our Terms of Service include Data Processing Terms (Schedule 1) that apply to every customer. If you need a separately signed DPA, ask your Typewise contact or write to info@typewise.app.
Typewise AG is a Swiss company based in Zurich. Our privacy policy is written for both the GDPR and the Swiss Federal Act on Data Protection (revDSG), and our Terms of Service are governed by Swiss law. Customer data is processed in the European Union and/or Switzerland.
