How we handle your data and work with AI.
Anyone who opens their processes, documents and systems to us wants to know what happens with them. This page says where data is processed, which tools we use, who has access and what you get from us in writing.
- Data processed in the EU, or in your environment on request
- Data processing agreement and TOMs on request
- Non-disclosure agreement before every project
- No customer data in public AI tools
- No AI models trained on your data
- Subprocessors disclosed and kept current
Overview
They apply regardless of service, tool or project size, and we write them into every contract.
- Data location
- EU or your infrastructure
- Encryption
- In transit (TLS) and at rest
- Access
- MFA, rights per project
- Subprocessors
- 8, see list
We process data only for the agreed purpose. We do not pass it on, sell it or train models on it, neither our own nor anyone else's.
Project data lives in European data centres or in your own infrastructure. For models outside the EU we use enterprise agreements only, with no training and no retention of inputs.
We work with the smallest data extract that is sufficient for the task, anonymised or pseudonymised where possible. Access is granted per project and revoked when it ends.
Which tools, which subprocessors, which access: we disclose this before the project starts and keep it current on this page. We inform ongoing customers of changes.
AI practices
Consulting, development and internal work at Nao run on AI tools. So that this is no risk for you, three rules apply to everyone on the team.
We work with AI every day. With clear rules.
3 controls- Approved tools only
We use AI platforms and models exclusively under enterprise agreements: Langdock, Azure OpenAI, Anthropic, Google. These agreements exclude training on our inputs. Free or personal versions of AI services are off limits for customer data.
- Customer data only with approval
Which of your data may go into which tool is agreed before the project starts. When in doubt, data stays in your environment and the model comes to the data, not the other way round.
- AI-assisted development with review
We develop with AI assistants when agreed in the project. Your source code stays in your repository or an environment set up for it. A person reviews every change before it is adopted.
Controls
The measures we implement in every project. Details and evidence are in the security overview and the TOMs.
Infrastructure
5 controls- Data processing in the EU
Project data in European data centres (Azure, AWS Frankfurt, Hetzner) or in your infrastructure.
- Encryption in transit and at rest
TLS for every connection, enforced via HSTS; storage encryption per provider standard.
- Separate project environments
A dedicated environment per customer, no shared data space between customers.
- Credentials in a password manager
Never in chats, emails or documents; rotated when people change.
- Website: tracking only with consent
Hosted on Cloudflare, web analytics without cookies. Session recording and LinkedIn ad measurement run only after you accept the notice, forms with bot protection.
Organisation
6 controls- Central identities with MFA
Multi-factor authentication for all systems, sign-in via a central directory.
- Least-privilege access
Rights granted per project and revoked when the project ends.
- Managed, encrypted devices
Automatic updates, full-disk encryption, no customer data on personal devices.
- Confidentiality obligations
Everyone on the team and external specialists are bound to confidentiality in writing.
- Review of new tools
Data processing, location and contract terms are reviewed before use.
- Incident process
Affected customers are informed without delay; statutory reporting deadlines are met.
Data protection
6 controls- Data processing agreement
Under Art. 28 GDPR with TOMs as annex, on our template or yours.
- Non-disclosure agreement
Before every project, on request before the intro call.
- Purpose limitation
Data is processed only for the agreed purpose, never passed on or sold.
- Data minimisation
Smallest necessary extract, anonymised or pseudonymised where possible.
- Deletion or return
After the project, as soon as no retention obligations apply; confirmation on request.
- Data subject rights
Support with access, rectification and erasure within statutory deadlines.
Nao Intelligence is not ISO 27001 certified. We align our security concept with ISO 27001 and the German BSI IT baseline protection and rely on providers that hold these certifications. In projects in regulated environments we work within your QM processes and deliver the documentation they require.
Subprocessors
These services process data on our behalf. Which of them are used in your project is stated in the DPA. We add new providers here before using them for customer data.
| Provider | Purpose | Location | Note |
|---|---|---|---|
| Microsoft | Email, documents, collaboration (Microsoft 365); development and operations (Azure, Azure OpenAI) | EU data centres | Enterprise agreement, EU Data Boundary |
| Langdock | AI platform for consulting and customer projects | Germany / EU | No training on inputs |
| Anthropic | Language models (Claude) via API | USA | Enterprise agreement, no training, no retention of inputs |
| OpenAI | Language models (GPT) via API | USA / EU processing where available | Enterprise agreement, no training |
| Google Cloud | Language models (Gemini), data platform | EU regions | Enterprise agreement, no training |
| Amazon Web Services | Operating solutions, sending transactional email | EU (Frankfurt) | For projects only at the customer’s request |
| Hetzner | Operating our own systems and customer solutions | Germany | Own servers, own administration |
| Cloudflare | Hosting, CDN and bot protection for this website | Global network, EU servers preferred | Website only, no project data |
| Measuring the impact of our LinkedIn ads (Insight Tag) | EU (Ireland) / USA | Only after consent on the website, no project data |
Documents
For your vendor assessment or QM system. Request via the contact form, delivered within a few days.
- Data processing agreement
Under Art. 28 GDPR, with an annex on technical and organisational measures.
On requestRequest - Security overview
Access concept, devices, project environments, handling of AI tools, incident process.
On requestRequest - Subprocessor list
Complete list with purpose, location and contractual basis, tailored per project.
On requestRequest - Non-disclosure agreement
Our template, or we sign yours.
On requestRequest - Proof of insurance
Confirmation of general and professional liability insurance.
On requestRequest - Vendor questionnaire
We complete your questionnaire, in your format and your tool.
On requestRequest
What IT and data protection ask us
Do you train AI models on our data?
No. Neither we nor the providers we use train models on your data. For all model providers we use enterprise agreements that rule this out.
Where is our data processed?
In European data centres or in your own infrastructure. We use models from providers outside the EU only under enterprise agreements with no training and no retention of inputs, and only when agreed in the project.
Can we run AI fully on-premises?
Yes. With open models such as Llama or Mistral we operate solutions in your data centre or private cloud. Then no request leaves your company. More under Private AI platforms and RAG.
Who at Nao has access to our data?
Only the people working on the project, with rights granted per project. External specialists from our network get access only with your consent and under the same confidentiality obligations.
What happens to our data after the project?
We delete project data or return it as soon as no contractual or statutory retention obligations apply, and confirm deletion in writing on request.
Will you sign our NDA and our DPA?
Yes. We are happy to work on your templates. If you don’t have any, we provide ours.
Report a security incident or vulnerability
If you discover a vulnerability in our systems or this website, or suspect an incident, write to us. We confirm receipt and get back to you personally.
security@naointelligence.comPlease do not include customer data or credentials in the report.