How we handleyour data and security
We don't hold SOC 2, ISO 27001, or any other security certification. This page describes what we actually do instead - hosting you control, access by role, no training on your data, and a plan for when something goes wrong.
What we do
| Area | Practice |
|---|---|
| AI providers | We usually build with OpenAI and Anthropic, and we've worked with more than 10 AI providers. We use whichever one your needs and your legal requirements allow. |
| Hosting region | You choose where your data is hosted: the EU or the US. |
| Agreements | We sign an NDA on almost every project, and a data processing agreement when your data needs one. |
| Model training | We don't train AI models on your data. |
| Access control | Access to your systems - code repositories, no-code platforms, your project portal - is set up per client, by role. |
| Team agreements | Everyone on our team works under an agreement with us, and loses access when they stop working with us. |
| Client ownership | You own the code, workflows, accounts and documentation. |
How your data moves
- Your data enters the system you control - your CRM, your inbox, your uploaded files, or directly from your own users.
- When an AI call is needed, the request goes to the provider you approved, scoped to only the data that call needs. No client data is used to train a model.
- Data is stored in the hosting region you chose.
- Access to the system - code, no-code platform, project portal - is role-based and set up per client.
- When someone stops working with Eterna, their access is removed. What happens to the data itself follows the agreement for that project.
Who else touches your data
Used only where the project needs them - not every project uses all of these.
| Subprocessor | Role | When used |
|---|---|---|
| Anthropic | AI model provider | When Claude is the model used for the build |
| OpenAI | AI model provider | When GPT models are the model used for the build |
| Supabase | Database and backend hosting | Custom application builds using Eterna's default stack |
| Vercel | Application hosting | Custom application and website builds |
| Bubble | No-code application platform | No-code builds |
| n8n | Automation and workflow platform | Automation engagements |
If something goes wrong
We monitor for problems, contain and fix quickly, and tell you within 72 hours of confirming an incident that affects your data.
Agreements on request
We sign an NDA on almost every project, and a data processing agreement when your data needs one.
Ask for a data processing agreement or our full security questionnaire pack and we'll send it.
GDPR and the EU AI Act
We don't sell certificates. We design for your obligations from the start: a data processing agreement when needed, hosting in the region you choose, and access limited by role. If what you want to build falls under the EU AI Act, we'll tell you on the first call what it means for the design, which usually comes down to human oversight and a clear record of what the AI did.
Have a security questionnaire?
Send it over and we'll fill it out from this page, plus whatever's specific to your project.
Book free strategy call