> Site index: [llms.txt](https://ortelian.com/llms.txt) with all pages and descriptions.

[Ortelian](https://ortelian.com/)

[Talk to us](https://ortelian.com/contact/)

Ortelian

# Trust Center

Source: https://ortelian.com/trust/
Markdown: https://ortelian.com/trust.md

Where Ortelian stores your data, which AI models see it, what agents may do and who processes it. Zero retention, no training, data in the EU.

How we protect the data our agents work with. Every commitment on this page is in our Data Processing Agreement.

[Request documents](https://ortelian.com/trust/request/)

[Contact security](mailto:security@ortelian.com)

**GDPR**

DPA in place

**Hosting**

EU

**Transfers**

DPF or SCCs

**SOC 2**

Planned

Updated 13 October 2026

## Controls

From DPA Annex II

### Data location

- Workspace database in Belgium
- World model, search and backups in the EU
- Logs in Germany, deleted after seven days
- Sign-in and agent mailboxes run in the US

### AI models

- Zero retention, bound in writing
- No training on customer data
- Approved routes only, no fallback
- EU-only routes on request

### Agents

- Read-only until a write is granted
- Outside actions wait for a person's approval by default
- Only your team can let an action run on its own
- Agents cannot create tools or grant themselves access
- Every run, action and approval recorded

### Access

- Each customer in its own workspace
- Staff access only where needed
- Multi-factor sign-in for staff
- Access reviewed and removed

Inside a workspace, every user sees all imported data.

### Encryption

- TLS in transit, verified to the database
- Encrypted at rest and in backups
- Credentials in AES-256-GCM
- Credentials never reach a model

### Incidents and deletion

- Breach notice within 48 hours
- Every incident reviewed within five business days
- Data deleted within 30 days of the end
- Backups expire within 60 days

## Subprocessors

6 companies · 14 AI providers

| Company | Purpose | Location | Region |
| --- | --- | --- | --- |
| Cloudflare | Application and agent runtime, world model, search and backups | EU jurisdiction | EU |
| PlanetScale | Workspace database and encrypted connector credentials | Belgium | EU |
| Datadog | Operational logs and traces | Germany | EU |
| OpenRouter | Routes AI requests to the providers below | Per provider | EU or US |
| Clerk | Sign-in for workspace users | United States | US |
| AgentMail | Agent mailboxes | United States | US |

AI providers through OpenRouter · zero retention, no training

**EU**

Mistral AI

**EU or US**

Microsoft AzureGoogle Vertex AIAmazon BedrockTogether AINebiusCloudflare Workers AIPrime IntellectCohereVoyage AI

**US**

xAITypeSafe AIDeepInfraFireworks AI

30 days' notice before any change, with a right to object. [Get notified](https://ortelian.com/trust/request/?doc=Subprocessor%20change%20notices)

## Documents

On request

- Data Processing Agreement

  Agreement · 12 pages

  [Request →](https://ortelian.com/trust/request/?doc=Data%20Processing%20Agreement)
- Security overview

  Summary · 1 page

  [Request →](https://ortelian.com/trust/request/?doc=Security%20overview)
- Transfer safeguards

  Per subprocessor and AI route

  [Request →](https://ortelian.com/trust/request/?doc=Transfer%20safeguards)
- AI provider legal entities

  Annex III detail

  [Request →](https://ortelian.com/trust/request/?doc=AI%20provider%20legal%20entities)
- Incident response process

  Process

  [Request →](https://ortelian.com/trust/request/?doc=Incident%20response%20process)
- Your security questionnaire

  Upload yours, we fill it in

  [Request →](https://ortelian.com/trust/request/?doc=Your%20security%20questionnaire)

## Questions

**Does Ortelian train AI models on our data?**

No. Your data is never used to train or improve a model. Every AI provider and gateway we use is bound in writing to keep nothing beyond a short in-memory cache, and to never train on your data.

**Can all our data stay in the EU?**

Your workspace, backups and stored embeddings are always in the EU. Model calls run in the EU or the US; ask in writing and we limit your workspace to EU routes only. Sign-in and agent mailboxes run in the US.

**Who inside our company can see the data agents use?**

Everyone in your workspace sees everything that was imported, even records they cannot open in the source tool. Connect only data that all of your workspace users may see.

**Can an agent send something without a person approving it?**

Only if your team sets it up that way. By default, any action that reaches the outside world, such as sending an email or an invoice, waits for a person's approval. Your team can allow a specific action to run without approval. Agents cannot create new tools or grant themselves access, and text in your data or a model's answer cannot change their permissions.

**Is Ortelian SOC 2 certified?**

Not yet. We plan to start the audit with Vanta. Our security measures are binding in Annex II of our Data Processing Agreement, and you can audit us once a year.

**Who is Ortelian's contracting entity?**

Ortelian, Inc., a Delaware corporation. The Data Processing Agreement is governed by Belgian law, with the courts of Brussels.

Security contact

[security@ortelian.com](mailto:security@ortelian.com)

Report a vulnerability

[security.txt](https://ortelian.com/.well-known/security.txt)

Questionnaires

[Send us yours](https://ortelian.com/trust/request/?doc=Your%20security%20questionnaire)

![Antwerp from across the Scheldt, with the Cathedral of Our Lady and the Boerentoren.](https://ortelian.com/assets/antwerp-skyline.webp)

[Ortelian](https://ortelian.com/)

Based in Antwerp. On site across Europe and the US. Hosted in the EU.

Ortelian, Inc. ·

[Est. 1570](https://ortelian.com/1570/)

Ortelian® is a registered EU trademark.