Security

Your knowledge.Under your control.

Private AI only works if the private part is real. Here is exactly where your data goes, who can see it, and what we never do with it.

Talk to our team Deployment options

Your infrastructure · on-premise or EU cloud

AI-VORTEX platform · roles · audit log

Your dataDocuments, calls, answers. Encrypted.

Third-party AI providers Model training Data resale

Germany & EU

Built for the rulesyou operate under.

AI-VORTEX is designed around German and European regulation, so your legal and security teams can approve it.

European UnionGDPR (DSGVO)Data stays in your chosen infrastructure; processing agreements under Art. 28; full data subject rights.

European UnionEU AI ActTransparent, source-backed answers with human oversight and logging for accountable AI use.

European UnionNIS2Access control, audit trails and incident logging that support your cybersecurity obligations.

European UnionData residencyHosted in Germany or on-premise; no transfers to third countries for your content.

GermanyBDSGGermany's Federal Data Protection Act, including rules for employee data.

GermanyTDDDGNo non-essential cookies or tracking without consent on our website.

Germany§ 203 StGBOn-premise option for professional secrecy holders: healthcare, legal, tax.

GermanyBSI / KRITISAir-gapped on-premise deployment for critical infrastructure operators.

See the standards we build against under Certifications.

Certifications & standards

The standardswe build against.

International and German frameworks for information security, privacy and AI. Documentation for your audit is available on request.

ISO/IEC27001AlignedInformation securityRisk-based controls for how we build, run and access the platform.
ISO/IEC27701AlignedPrivacy managementExtends 27001 to personal data, mapped to the GDPR.
ISO/IEC42001AlignedAI managementGovernance, transparency and oversight for AI systems.
BSIC5AlignedCloud securityThe German federal catalogue for secure cloud services.
BSIIT-GSAlignedIT-GrundschutzGerman baseline protection for on-premise operation.

"Aligned" means our controls and processes follow the standard. It is not a claim of independent certification. Ask us for the current status and our documentation.

Principles

Six promises.No exceptions.

Your boundaryDocuments, calls and answers stay in the infrastructure you choose.

No training on your dataYour content is never used to train any model, ours or anyone else's.

Role-based accessThe AI answers only from what each person is allowed to see.

Full audit trailEvery question, answer, source and access is logged for review.

EncryptionData is encrypted in transit and at rest.

Traceable answersEvery answer points to the document and section it came from.

Deployment

On-premiseor EU cloud.

Same product, same features. You choose where it runs.

	On-premise	EU cloud
Where it runs	Your data centre	Our EU cloud, hosted in Germany
Who operates it	Your IT, with our support	AI-VORTEX, for you
Internet required	No, can run fully offline	Yes, over encrypted connections
Time to start	Weeks, depends on your hardware	Days
Best for	Critical infrastructure, strict air-gapped rules	Fast rollout, growing teams

What we never do

Clear lines.In writing.

We always

Keep your data in the deployment you choose
Respect your roles and permissions
Log every access for your review
Let you export or delete your data

We never

Train models on your content
Send your documents to third-party AI providers
Sell or share your data
Answer from sources a user may not see

Security FAQ

The hardquestions.

Is AI-VORTEX certified under ISO 27001?

Our platform is designed along ISO/IEC 27001, 27701 and 42001 and the BSI C5 catalogue. This describes our approach and is not a claim of independent certification. Ask us for the current status and documentation.

Do you use third-party AI providers?

Not with your content. Models run inside your chosen deployment; your documents are not sent to third-party model providers.

Can we run it without internet?

Yes. The on-premise deployment can run fully inside your own network.

Who can see the audit log?

Admins you name. Logs can be exported for internal review or an external audit.

Bring your security team.

We'll walk them through architecture, data flows and our documentation.

Book a time

Prefer to write? Contact us

Hosted in Germany
GDPR by design
Answer within 1 working day