ZeugnyAI

Question 1

Do you use our data to train AI models?

Accepted Answer

No. We do not use customer data to train, fine-tune or evaluate models, and customer requests never enter our reference corpus.

Model providers receive pseudonymised text only. Microsoft's terms for Azure AI Foundry exclude training on customer inputs; for steps routed through OpenRouter, the terms of the upstream provider apply.

Question 2

Where is our data stored?

Accepted Answer

In the managed Cloud, in Microsoft Azure Switzerland North (Zürich): database, backups, files, keys and logs. Backups and files are also replicated to a second Swiss region, Switzerland West. With Self-Hosted, in your own infrastructure.

Pseudonymised engine records are kept on the same Swiss database server and in Cloudflare R2 object storage.

Question 3

What exactly does the AI see?

Accepted Answer

Pseudonymised certificate input: ratings, job title, tasks, dates shifted by a constant offset, and placeholder names and employers. It does not see real names, employers, e-mail addresses or employee IDs.

Place of birth and nationality, when you enter them, are sent as written.

Question 4

Can ZeugnyAI staff see our employees' data?

Accepted Answer

Our staff tools show no certificate content or employee records; they do list your users' names, e-mail addresses and roles. As the operator of the managed Cloud we have technical access to its database, as any hosting provider does; that access is restricted to named administrators, and sign-in to our staff tools requires a second factor.

The engine's operator dashboard shows each request's pseudonymised prompts and model responses and is open to signed-in operators only. With Self-Hosted we have no access to your platform at all. The engine holds the pseudonymised text described above.

Question 5

What happens to our data when we leave?

Accepted Answer

Download your finalised certificates, then tell us: we delete your company's records from the platform database, and backups age out within 60 days. Today this is an operator task; a self-service export and deletion is planned.

The engine keeps its pseudonymised records until the planned retention limit and customer-facing deletion are in place. The pseudonym mappings that link them to real people are held in the platform database.

Question 6

Do you have ISO 27001 or SOC 2?

Accepted Answer

Certification is on our roadmap. Today we give your team direct evidence: the status of every control on this page, full source access for Self-Hosted customers, and answers to your security questionnaire.

Question 7

Can we run a penetration test?

Accepted Answer

Yes, against your own Self-Hosted installation at any time. For the managed Cloud, agree scope and timing with us first, and we provide a separate test company.

Question 8

How will you tell us about a security incident?

Accepted Answer

If an incident affects your data, we inform your named contact without undue delay after we confirm it: what happened, which data is affected and what we are doing about it.

That gives you what you need for your own duties, such as notifying the FDPIC under the Swiss FADP or the supervisory authority within 72 hours under the GDPR.

Security you can check, not just trust.

Frameworks and where we stand

Swiss FADP (revDSG)

22 mapped controls