ZeugnyAI

Question 1

Do you use our data to train AI models?

Accepted Answer

No. We do not use customer data to train, fine-tune or evaluate models, and customer requests never enter our reference corpus.

Model providers receive pseudonymised text only. Microsoft's terms for Azure AI Foundry exclude training on customer inputs; for steps routed through OpenRouter, the terms of the upstream provider apply.

Question 2

Where is our data stored?

Accepted Answer

In the managed Cloud, in Microsoft Azure Switzerland North (Zürich): database, backups, files, keys and logs. Backups and files are also replicated to a second Swiss region, Switzerland West. With Self-Hosted, in your own infrastructure.

Pseudonymised engine records are kept on the same Swiss database server and in Cloudflare R2 object storage.

Question 3

What exactly does the AI see?

Accepted Answer

Pseudonymised certificate input: ratings, job title, tasks, dates shifted by a constant offset, and placeholder names and employers. It does not see real names, employers, e-mail addresses or employee IDs.

Place of birth and nationality, when you enter them, are sent as written.

Question 4

Can ZeugnyAI staff see our employees' data?

Accepted Answer

Our staff tools show no certificate content or employee records; they do list your users' names, e-mail addresses and roles. As the operator of the managed Cloud we have technical access to its database, as any hosting provider does; that access is restricted to named administrators, and sign-in to our staff tools requires a second factor.

The engine's operator dashboard shows each request's pseudonymised prompts and model responses and is open to signed-in operators only. With Self-Hosted we have no access to your platform at all. The engine holds the pseudonymised text described above.

Question 5

What happens to our data when we leave?

Accepted Answer

Download your finalised certificates, then tell us: we delete your company's records from the platform database, and backups age out within 60 days. Today this is an operator task; a self-service export and deletion is planned.

The engine keeps its pseudonymised records until the planned retention limit and customer-facing deletion are in place. The pseudonym mappings that link them to real people are held in the platform database.

Question 6

Do you have ISO 27001 or SOC 2?

Accepted Answer

Certification is on our roadmap. Today we give your team direct evidence: the status of every control on this page, full source access for Self-Hosted customers, and answers to your security questionnaire.

Question 7

Can we run a penetration test?

Accepted Answer

Yes, against your own Self-Hosted installation at any time. For the managed Cloud, agree scope and timing with us first, and we provide a separate test company.

Question 8

How will you tell us about a security incident?

Accepted Answer

If an incident affects your data, we inform your named contact without undue delay after we confirm it: what happened, which data is affected and what we are doing about it.

That gives you what you need for your own duties, such as notifying the FDPIC under the Swiss FADP or the supervisory authority within 72 hours under the GDPR.

Data	Stored in	Region	Protection
Employee records, ratings, drafts and certificates	Azure Database for PostgreSQL	Switzerland North (Zürich)	TLS in transit; encrypted at rest by Azure; pseudonym mappings additionally AES-256-GCM
Scans of signed paper certificates	Same database	Switzerland North (Zürich)	As above
Backups	Point-in-time restore (35 days) and nightly dumps in Azure Storage	Switzerland North (Zürich); copy in Switzerland West	Encrypted at rest by Azure; kept in two Swiss regions; dumps are made on a ZeugnyAI-operated CI runner and uploaded over HTTPS
Keys and secrets	Azure Key Vault	Switzerland North (Zürich)	Role-based access, soft delete
Application and database logs	Azure Log Analytics	Switzerland North (Zürich)	Kept for 30 days
Pseudonymised engine records: requests, model prompts and responses, intermediate results, a response cache	Engine database on the same server, and Cloudflare R2 object storage	Switzerland North (database); Cloudflare global network (R2)	Known names, employers and dates replaced; retention limit and deletion planned

Provider	Purpose	Data received	Location
Microsoft Azure	Hosting, database, backups, key management, logs	Personal data	Switzerland North (Zürich); backup copies in Switzerland West
Cloudflare	Engine hosting and storage; delivery of notification e-mails	Pseudonymised text (engine); recipient address, name and link (e-mail)	Global network
Microsoft Azure AI Foundry	Language models that write and check certificate text	Pseudonymised text	Resource in Switzerland North; processing within the EU data zone (Data Zone Standard)
Microsoft Azure AI Foundry (Decision-1)	Decision model: next question, consistency checks	Pseudonymised structured data	Resource in Sweden Central; EU Data Zone Standard deployment
OpenRouter and the inference providers it routes to	Document extraction, classification, search queries; job-title and task suggestions	Pseudonymised text; job titles and task lists	Global; depends on the upstream provider
Voyage AI	Search and ranking in our reference corpus	Pseudonymised search text, such as job titles and tasks	USA
Google	Optional “Sign in with Google”	Name and e-mail address of the person signing in	Global

Data	Kept for	How it ends
Personal data of former employees	10 years after the end of employment by default; other periods on request	An hourly job redacts name, contact and birth details, erases drafts and deletes the pseudonym mappings; job assignments are kept
Issued certificates	As long as they must remain verifiable and reissuable	On an erasure request they are marked deleted and removed from every view, unless a legal hold applies
Audit trail	For the life of your account	Kept as evidence; entries are never edited
Backups	35 days (point-in-time); nightly dumps up to 60 days including soft delete	Expire automatically
Logs	30 days	Expire automatically
Pseudonymised engine records	Kept until the planned retention limit takes effect	An automatic retention limit and a customer-facing deletion are planned

Security you can check, not just trust.

Where data lives, who processes it, how long it stays

Where data is stored

Subprocessors

How long data is kept