Your process data stays in the European Union
See where your data is stored, how it is isolated from other customers, whether AI learns from your content, and who processes it. We describe only what is actually in our architecture and contracts.
- EU hostingGoogle Cloud, Warsaw region
- GDPR and DPAdata processing agreement available for download
- Data isolationRow Level Security in the database
- No AI trainingon the content of your procedures
01Hosting
The application and database run on Google Cloud in the Warsaw region (europe-central2). Backups are stored in the EU.
02Data isolation
Each organization is isolated in the database by Row Level Security policies. The application has no code path that bypasses this isolation — including for the support team.
03Encryption
Connections are encrypted with TLS. Data on Google Cloud infrastructure is protected by the provider's encryption.
04Access and sign-in
Passkeys and MFA, an organization-wide password policy, and roles: Owner, Administrator, Author, Approver, Reader. SSO available on request.
05AI and your data
06AI agents
OAuth 2.1 with scopes. An agent acts on behalf of a person and cannot approve or publish. Every call is recorded in the organization's log, and access can be revoked at any time. More about agents
07Audit
A log of changes and decisions within the organization. Operational logs do not contain procedure content — the ProcessCraft operator sees metadata, not content. Support access only with an Administrator grant.
08Subprocessors
| Entity | Purpose | Data location | Transfer mechanism |
|---|---|---|---|
| EntityGoogle Cloud EMEA Ltd. | PurposeHosting, database, AI model (Vertex AI) | Data locationEU (Warsaw) | Transfer mechanismno transfer outside the EEA |
| EntityStripe Payments Europe Ltd. | PurposeCard payments, BLIK | Data locationEU (Ireland) | Transfer mechanismSCCs (Stripe entities in the US) |
| EntityBrevo SAS | PurposeEmail delivery | Data locationEU (France) | Transfer mechanismno transfer outside the EEA |
| EntityPlausible Insights OÜ | PurposeCookieless website analytics | Data locationEU (Germany) | Transfer mechanismno transfer outside the EEA |
Self-hosted installations have no separate hosting subprocessor. Current subprocessor list and changes
09Backups and continuity
We retain backups for 35 days. You can export all of your organization's data at any time (PDF, BPMN). We do not commit to an RPO or RTO.
10Incidents
We announce incidents through an in-app notice and an email to the organization. We notify the customer (as data controller) of a personal data breach without undue delay, in accordance with the DPA. We do not operate a public status page. Help Center: current notices
11Report a vulnerability
We follow a responsible disclosure policy: we respond within 2 business days and take no legal action against anyone acting in good faith. The /.well-known/security.txt file contains our PGP key.
12Documents
- Data Processing Agreement (DPA)PDF · version 2 · June 1, 2026
- Privacy Policyversion 3 · June 1, 2026
- AI Acceptable Use Policyversion 1 · March 1, 2026
Security questions before you buy?
We will complete your security questionnaire and send you the DPA for signature.