KERVALT / PRIVACY
Your data is yours. Full stop.
Privacy is not a line in our policy. It is built into how Kervalt works: European data centers, keys you control, and options to leave no copy behind. We do not train models on your data. Ever.
01 / PRINCIPLES
Privacy principles
How we handle your data from the moment it arrives until the moment it is deleted.
No model training on customer data
Your prompts, documents, and outputs are never used to train or improve any model.
Zero-data-retention options
Enterprise customers can set inputs and outputs to be deleted right after processing.
Data minimization
We only collect what we need to run the service and help you.
Purpose limitation
We use your data only to deliver the service we agreed to. Never for ads. Never for unrelated studies.
Transparent subprocessors
We list every outside company that touches your data, and they are all EU-based.
Individual rights support
Tools and workflows to help you respond when someone asks to see, fix, or delete their data.
02 / HANDLING
Data handling practices
Default and configurable controls for every stage of your data's life.
Retention
Default retention follows your subscription terms. Enterprise customers can set custom windows, including immediate deletion after use.
Encryption
Data is locked with AES-256 when stored and TLS 1.3 when moving. Enterprise customers can hold their own keys.
Access controls
Role-based access, least-privilege rules, multi-factor authentication, and full audit logs limit who inside Kervalt can reach your data.
Cross-border transfers
Your data stays in the EU region you choose. We do not move it to places that would weaken GDPR or professional secrecy protections.
03 / SUBPROCESSORS
Subprocessors
All subprocessors are located in the European Union and bound by GDPR-compliant data processing terms.
| Subprocessor | Function | Location |
|---|---|---|
| EU Infrastructure Provider | Processing and storage hosting | Germany / France |
| EU CDN Provider | Static asset delivery | Netherlands |
| EU Monitoring Provider | Infrastructure observability | Ireland |
NEXT STEP
Need a Data Processing Addendum?
Our legal team can provide a standard DPA tailored to your jurisdiction and industry.