Trust
Trust Centre
Last updated: 2026-08-01
Every row on this page is generated from versioned files in the source repository that defines them, not written by hand. Where we have not yet verified something against our production systems, this page says so instead of stating it.
Data residency
Where each category of data actually lives. A region is stated here only once it has been verified against the deployed environment; the rest say so plainly.
| Data | Region | Status |
|---|---|---|
| Database recordsAll platform records: workspaces, proposals, documents metadata, members, audit trails | Germany West Central (Frankfurt) | Verified |
| Uploaded and generated filesDocuments members upload, and files the platform generates | Automatic placement (not region-pinned) | Verified |
| Document content sent for parsingThe full text of every uploaded tender document, sent to the parser | United States | Verified |
| Generative model inference (drafting, extraction, summarisation)Prompts and completions for the document and extraction paths. The conversational agent is listed separately below because it resolves differently. | Europe (Stockholm), eu-north-1 | Verified |
| Text embeddingsVector embeddings computed over document chunks and queries | Europe (Stockholm), eu-north-1 | Verified |
| Meeting audio and transcriptsUploaded meeting recordings and their machine transcripts | Europe (Stockholm), eu-north-1 | Verified |
| Conversational agent inferencePrompts and completions for the in-app chat agent, which reads the workspace content a member is authorised to see. | Being verified (#1909 - awaiting a deployed-environment read of the agent model actually in use) | Being verified |
1 of 7 categories are still being verified against our production logs. We would rather show you an unfinished table than a claim we cannot yet evidence.
Sub-processors
Every third party that receives data from the platform. Providers that are wired but switched off in production are listed with that stated, rather than omitted - each is one configuration change away from being on.
| Processor | Purpose | Region | In production | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services - Amazon BedrockTouches customer content | Generative model inference (drafting, extraction, summarisation, the chat agent) and text embeddings | Europe (Stockholm), eu-north-1 | Yes | Not applicable |
| Amazon Web Services - Amazon Transcribe and S3Touches customer content | Speech-to-text for meeting recordings, and the S3 bucket staging the audio for it | Europe (Stockholm), eu-north-1 | Yes | Not applicable |
| CloudflareTouches customer content | Object storage for uploaded documents and generated files, and content delivery | Automatic placement | Yes | EU Standard Contractual Clauses |
| Google - sign-in and document connectorsTouches customer content | Federated sign-in, and member-initiated document-source connections | United States | Yes | EU-U.S. Data Privacy Framework |
| LlamaIndex - LlamaParseTouches customer content | Parsing uploaded documents into text. This is the default parser, and it receives the entire document. | United States | Yes | EU Standard Contractual Clauses |
| Microsoft - sign-in and SharePoint connectorTouches customer content | Federated sign-in, and member-initiated SharePoint document connections | United States | Yes | EU-U.S. Data Privacy Framework |
| Microsoft AzureTouches customer content | Underlying infrastructure on which the Neon database runs | Germany West Central (Frankfurt) | Yes | Not applicable |
| NeonTouches customer content | Managed PostgreSQL holding all platform records | Germany West Central (Frankfurt) | Yes | Not applicable |
| TavilyTouches customer content | Web-search enrichment for research and the chat agent. Receives the search query, which may be derived from customer content. | United States | Yes | EU Standard Contractual Clauses |
| Bolagsverket (Swedish Companies Registration Office)Touches customer content | Cold-start org profiling: an organisationsnummer the customer enters about their own organisation is sent to the free 'vardefulla datamangder' open-data API, which returns the public register record (name, SNI activity codes, registered address, activity description). | Not in use | No | No transfer outside the EEA. Bolagsverket is a Swedish public authority acting as controller for the register; the API is published free under the EU open-data directive and no agreement is required to read it. |
| DocuSignTouches customer content | Member-initiated e-signature connector | Not in use | No | EU-U.S. Data Privacy Framework would apply if enabled |
| Google - Gemini APITouches customer content | Alternative document-parsing path (PARSER_TYPE=gemini), and the optional notice-translation path | Not in use | No | EU Standard Contractual Clauses would apply if enabled |
| Microsoft Azure OpenAI ServiceTouches customer content | Alternative generative provider | Not in use | No | EU Standard Contractual Clauses would apply if enabled |
| OpenAITouches customer content | Alternative generative and embedding provider | Not in use | No | EU Standard Contractual Clauses would apply if enabled |
| Google (Gmail SMTP relay) | Fallback transport for transactional email when Resend is not configured or fails. Carries the message body, so it sees email content. | United States | Yes | EU-U.S. Data Privacy Framework |
| Pexels | Stock imagery lookup for generated document headers. Receives a search term, not customer documents. | United States | Yes | EU Standard Contractual Clauses |
| Resend | Transactional email: invitations, saved-search alerts, and customer-initiated outreach | United States | Yes | EU-U.S. Data Privacy Framework / EU Standard Contractual Clauses |
| Stripe | Subscription billing and payment processing. Card data is processed by Stripe and never reaches Klarum systems. | United States | Yes | EU-U.S. Data Privacy Framework |
| Vercel | Hosting for the web frontend | Being verified (#1909) | Yes | EU Standard Contractual Clauses |
| HubSpot | Member-initiated CRM connector. Distinct from Klarum's own internal CRM use, which is not a platform sub-processor. | Not in use | No | EU-U.S. Data Privacy Framework would apply if enabled |
| Salesforce | Member-initiated CRM connector | Not in use | No | EU-U.S. Data Privacy Framework would apply if enabled |
| Slack | Member-initiated workspace connector | Not in use | No | EU-U.S. Data Privacy Framework would apply if enabled |
22 processors listed. A longer list is the honest outcome of enumerating everything rather than only the flattering entries.
Data use and model training
Customer content is never used to train or fine-tune foundation models, whether by Klarum or by a model provider acting on Klarum's behalf.
Absolute. It is not configurable and there is no switch that turns it off.
Your organisation's control
Beyond serving your own organisation, Klarum does not use your content or your interaction signals for anything unless your organisation opts in.
The default is the restrictive value. An organisation that never touches this setting is never included in cross-organisation model improvement. That makes the setting a stated guarantee with an audit trail rather than a toggle between two live behaviours, which is the honest description of it.
What that setting gates
- Cross-organisation ranking-model training - pipeline/scripts/train_ltr_artifacts.py reads labelled rows from match_signal_log across every organisation and fits one shared logistic-regression weights artifact plus an isotonic calibrator. Those artifacts are then applied to every organisation's match scoring when LEARNED_WEIGHTS_ENABLED / LEARNED_CALIBRATION_ENABLED are on.
What it deliberately does not gate
- Serving your own organisation - Matching, ranking, retrieval, drafting and the per-organisation personal recommender all operate on your data to serve you. That is the product, and the setting does not affect it.
- Foundation-model training - Already prohibited absolutely by the commitment above. There is nothing for a switch to control.
- Aggregate operational metrics - Counts, latencies and error rates carry no customer content and are used to run the service.
Per provider
- aws-bedrockThe provider does not retain prompt content and does not train on inputs or outputs.
- llamaindexUnder review. LlamaParse receives the entire document, and its terms are not the same as Bedrock's. Until the terms are read and recorded here, no no-training statement is made for this path.
- google-geminiNot applicable in production; the path is off. If enabled as a parser, the Gemini API terms must be read and recorded here first, because the paid and free tiers differ on training use.
- tavilyReceives search queries, which may be derived from customer content. Its retention and training position has not been recorded.
What we retain
Klarum does retain the working record of AI-assisted work inside the customer's own tenant, because the product would not function otherwise.
Retention
There is no automated retention enforcement anywhere in the platform. Nothing is deleted unless a person deletes it.
| Data | Position |
|---|---|
| Customer data in workspaces | Retained for the life of the subscription and deleted on termination. Deletion is performed by our team on termination or on request; there is no automated purge. |
| Soft-deleted records | Deleted records are removed from the product immediately. They are not yet purged from storage on a schedule. |
| Expired sessions (refresh tokens) | Sessions expire and stop working on expiry. Expired session records are not yet swept from storage. |
| Password-reset tokens | Single-use and short-lived. Consumed on use; expired unused rows are not yet swept. |
| Public procurement notices | Retained indefinitely. This is public data published by contracting authorities, and it is not customer data. |
| Billing records | Retained for 7 years from the end of the financial year, as Swedish accounting law requires. |
Security measures we operate
Our security notice states the controls we operate, each with whether it is in place, partial, or planned. It withdraws, in writing, any control an earlier revision overstated. Our privacy policy covers lawful bases, your rights, and international transfers.
Requesting a data processing agreement
Email security@klarum.com for a data processing agreement, our current record of processing activities, or the detailed security package.
How this page is kept true
The tables above are generated at build time from versioned files in our source repository. A continuous-integration check fails our build when the code gains a third-party client, or changes a region, that those files do not describe - so this page cannot quietly fall out of date with the software it describes.
Source: Klarum-Software/pivi/docs/trust at 9695fad22bf0