Humaify Trust Center

We define processing purposes, roles and responsibilities for each project. Where personal data is processed on your behalf, the agreed data processing agreement and the applicable data protection requirements form the basis.

External services are selected according to their purpose, the data they process and the safeguards required. Storage locations, international access, retention and deletion are considered separately. A European server location does not automatically mean that every processing step takes place in Europe.

Please send enquiries about data protection and project documents to hallo@humaify.de.

Our protection principles include restricted access rights, protected transmission paths, careful handling of credentials, data minimisation and the separation of customer environments. Backup and recovery are defined for each project.

Which measures are agreed and actually in place for your application is set out in the project-specific information and the related evidence. Specific security configurations and confidential technical documents are provided to authorised recipients through suitable protected channels.

We run our applications on Railway. Railway is a US provider. Region, backups, platform logs and support access are described in the project-specific information.

We distinguish between the location of an application, the registered seat and legal jurisdictions of its providers, and further data flows. These can include databases, file storage, backups, technical logs and support access.

Project-specific information names the services used or planned, their purpose, the relevant data flows and known limitations. Components that have not yet been determined are marked as such. Changes are recorded in the respective information.

Whether and how AI is used depends on the agreed application. Before use, the specific service, the data transmitted, processing locations and the required safeguards are determined.

For AI models we use OpenAI with zero data retention. Your data is not stored by OpenAI and not used for training. What an application itself stores, such as conversation logs, and for how long is defined in the project.

Under our project agreements, confidential client data may not be used for the general training of AI models. If a project uses a different AI service, its provider terms and configuration must cover this as well. We do not give a blanket assurance that every AI service operates without storage or exclusively in the EU. The actual characteristics are described for each project.

For an export or a switch of provider, we agree with you on the scope of data, formats, authorised recipients and the handover process. The project-specific information explains the available procedures, data structures and technical limitations, as well as return and deletion.

Customer data and agreed documents are released only to authorised recipients. The information pages themselves contain no personal export links or customer data.