Security you can check, not just trust.

Inside the platform, the PII boundary replaces the names of employees, managers and signatories, employer and company names, dates, work e-mail addresses and employee IDs with consistent pseudonyms before a request reaches the engine, and restores them in the answer. It wraps the engine calls of the HR platform, the lifecycle worker, ZeugnyAI Chat (which reaches the engine only through the platform) and the Word gateway.

A request is refused, not sent, when the encryption key or document scope is missing, a known person or employer has no pseudonym, a name part is ambiguous between two people, or the audit entry cannot be written.

Place of birth, nationality, job titles, departments, the company description and task text are sent as written; the text needs most of them. Names typed into free text are replaced only when they match a known person or employer. A stricter mode that holds unrecognised free text for human review is built; enabling it in the managed Cloud is planned.

The database, backups, file storage, key vault, logs and application servers of the managed Cloud run in Microsoft Azure Switzerland North (Zürich). Backups and file storage are replicated to a second Swiss region, Switzerland West. app.zeugny.com resolves directly to Zürich, with no content-delivery network in between. A signer's IP address is kept as signing evidence and is not sent to any third-party geolocation service; the country is read from a header set at the network edge.

All apps accept HTTPS only, with TLS 1.2 as the minimum; TLS 1.3 is negotiated in practice. The database server accepts TLS connections only, with TLS 1.2 as the minimum, and the platform's database connections request TLS.

Azure encrypts the database, backups and file storage at rest. On top of that, the platform encrypts pseudonym mappings and engine API keys with AES-256-GCM under master keys held in Azure Key Vault. Other records rely on Azure's encryption.

Once the retention period has passed (10 years after the end of employment by default), an hourly job redacts a former employee's name, e-mail address, date and place of birth and nationality, erases drafts and deletes the pseudonym mappings. Job assignments, the audit trail and issued certificates are kept; issued certificates still contain the name. We set a different period for your company on request; self-service configuration is planned.

Employees file access and deletion requests themselves under My privacy, and HR tracks each one against a 30-day deadline. Erasure redacts the employee's records, removes vault entries and shares, and issues a receipt. An access request produces a summary; a downloadable copy of the data is planned.

HR partners can place a legal hold on an employment and all its certificates, which pauses deletion. Employees can dispute a certificate; an accepted dispute produces a new version, and the history stays in the audit trail.

Managers, or HR, rate each aspect of performance and conduct. The AI writes text that matches those ratings and cannot change them. The overall level is calculated from the ratings, not chosen by the model.

No certificate reaches an employee without review and finalisation by an HR partner or administrator. Automations can start requests but never finalise them.

We do not use customer data to train, fine-tune or evaluate models, and customer requests never enter our reference corpus.

Certificate text is written by models on Microsoft Azure AI Foundry, on a resource in Switzerland North with an EU Data Zone Standard deployment, so requests are processed within the EU data zone. Decision, extraction and retrieval steps also use Microsoft Decision-1 (an Azure AI Foundry resource in Sweden Central with an EU Data Zone Standard deployment), OpenRouter and Voyage AI, and the platform uses OpenRouter directly to suggest job titles and tasks. Providers receive pseudonymised text only. Every request the engine sends to OpenRouter requires providers that do not collect user data, with no setting to switch this off. Zero-data-retention routing is planned.

Passwords are hashed with scrypt and need at least 8 characters. E-mail addresses are verified before the first password sign-in, and passwordless magic links expire after 5 minutes. Sign-in attempts are rate-limited per IP address.

With single sign-on, your identity provider's MFA applies to every sign-in. Staff accounts in our control plane need a second factor (an authenticator code or a backup code) for every session, and no engine operator login is issued without it. A built-in second factor for customer password sign-in is planned.

Every route checks relationship-based permissions. HR coordinators can draft but cannot finalise, override a finding, sign or download the official document. Works councils see aggregate figures only; managers see their own direct reports.

In the managed Cloud, companies share one Swiss database. The application confines every request to one company and checks permissions on each object. Self-Hosted gives each customer its own database. Row-level enforcement in the database is planned as a second layer.

Every lifecycle step and change is written to an audit log in which each entry carries the hash of the previous one, so an edited entry breaks the chain. The chain is checked when a dossier or verification page is opened, and each certificate's dossier can be downloaded with its audit entries.

If an incident affects your data, we inform your named contact without undue delay after we confirm it, with what happened, which data is affected and what we are doing about it. A written incident response plan is drafted and is published after legal review; regular exercises are planned.

The database can be restored to any point in the last 35 days. In addition, a scheduled job dumps all databases every night. It runs on a ZeugnyAI-operated CI runner, which connects over TLS, writes each dump to a temporary file, uploads it to Azure Storage in Switzerland North and deletes the file. The last 30 dumps of each database are kept, and deleted dumps stay recoverable for 30 more days. The stored backups, point-in-time and dumps, are kept in Switzerland North and replicated to Switzerland West, a second Swiss region.

Every provider that processes data for the Cloud is listed on this page with its purpose, the data it receives and its location.

A standard data processing agreement under the Swiss FADP and the GDPR is drafted and is published after legal review. Until then, we review and sign yours.