Data Protection

1. Hosting & Server Location

Where is Ayunis Core hosted? In which data centers?

The platform and all data stored at Ayunis (user data, chat content, knowledge base content) is held at Hetzner in Nuremberg, Germany.

On which servers do the language models (LLMs) run? Are Mistral/Llama hosted in your data center?

The models are provided via external providers, all hosted in the EU or in Germany:

Open-source models (GPT OSS, Qwen 3): by StackIT in Germany (several locations in DE)
OpenAI (GPT 5.4, GPT 5.4 mini): by Microsoft Azure in Europe
Anthropic (Claude Haiku 4.5, Opus 4.7, Sonnet 4.6): by AWS in Germany/Frankfurt
Mistral (Mistral Medium 3.1): by Mistral in Europe
Image generation (GPT Image 1): hosted in the EU

System admins can restrict the models on offer. For each model, the region is indicated by a flag.

Which image generation models are hosted in the EU?

GPT Image 1 (and successor models), hosted in the EU.

How is it ensured that the data stays in the EU? Are there written records/confirmations?

Yes. This is part of the privacy terms and legal documents (https://www.ayunis.com/rechtliche-dokumente).

2. Data Transfer to LLM Providers & US Transfer

If the models (including US models) run externally – how is it ensured that no data flows to or is stored in the USA?

Technical flow of a request (see architecture diagram):

Input (user interface): The user enters a prompt; the response is displayed in the same place.
API / frontend server (Ayunis Core): The request runs via our server. All user, chat and document content is stored in our database at Hetzner (Nuremberg, DE). The LLM provider is purely an inference provider without its own persistent store of the customer’s data.
Preprocessing – anonymization (optional, in anonymous mode): Before transmission to the external provider, personal data is detected on our own infrastructure (Hetzner, DE) by the anonymization/NER model and replaced with placeholders or masked (see section 6). This step takes place without involving external services.
Model call via EU/DE endpoints: To generate the response, the (potentially anonymized) prompt, including relevant context, is transmitted via API to a model endpoint hosted in the EU/DE (e.g. US models via Azure deployments localized in Europe, see section 1). The transmission is transport-encrypted (TLS).
Processing without persistence at the provider (AI provider): The provider processes the transmitted data only transiently to generate the response (inference). There is no storage, no logging of the content and no use for model training – contractually assured (API/enterprise terms).
Postprocessing – de-anonymization: The generated response is post-processed on our infrastructure (Hetzner, DE); in anonymous mode, the placeholders are mapped back to the original values (known only to us) (de-anonymization, see section 6). The response is then stored together with the history in our database and returned to the user.

Result: In anonymous mode, personal data in clear text does not leave the Ayunis Core server; regardless of this, content is only processed transiently for inference at the provider, and the persistent data store is located entirely in Germany.

What is the difference between using ChatGPT directly and via Ayunis Core when the LLM is located abroad?

With Ayunis Core, the models are sourced EU/DE-hosted, the data stays with us (DE), and there is no storage and no training at the provider. In addition, anonymous mode can redact personal data before transmission.

When using ChatGPT via the Open Telekom Cloud – does data still end up in the USA because OpenAI requires it for training purposes?

Via the API/interface, the data is not used for training purposes; only data from the ChatGPT web app would be used for training. The Open Telekom Cloud uses MS Azure as a subcontractor for the OpenAI models; training is excluded there too.

3. DPA, Subcontractors & Sub-Processors

What does the data processing agreement (DPA) look like and which subcontractors/sub-processors are named?

The DPA, including the list of subcontractors, is available at https://www.ayunis.com/avv. Which models/providers are used is decided by the customer.

4. Data Storage & Deletion

How long are chat histories and data stored in Ayunis Core? Are deletion periods supported?

Deletion periods can be configured in the account. If no deletion period is set, chat histories and data remain stored until they are deleted. Storage location: Hetzner (Germany).

When a chat is deleted – is the data then gone, or does it remain stored? Can a customer account be fully deleted?

A deleted chat is completely deleted. Customer accounts can be fully deleted.

Where exactly are the documents that are uploaded to the knowledge base stored?

The uploaded original files (e.g. PDFs) are discarded after processing. The document content is held – like user data and chat content – in our database, physically at Hetzner in Nuremberg.

Is the history stored and does it have to be deleted manually?

Histories are stored with us (Hetzner, DE); chats and accounts can be deleted; deletion periods can be configured in the account.

5. Use for Training Purposes

Is there an opt-out for the use of data for training purposes?

The exclusion is active by default – the data is not used for training purposes. The providers contractually guarantee that transmitted data is neither stored nor used for training.

Can an explicit exclusion of use for training purposes be assured?

Yes, this is governed in the data protection concept.

6. Anonymization / Anonymous Mode

The anonymization (masking) runs on our own infrastructure (Hetzner); in doing so, no data is transmitted to external services. To reduce data protection risks, content is automatically anonymized before being passed on to external AI models, so that no directly identifiable personal data is transmitted.

When does the masking take effect, or when is anonymous mode active, and what is masked?

Masking always takes place when a conversation is conducted in anonymous mode. This mode is active when:

the user explicitly creates the conversation as anonymous, or
an AI model is used that only processes anonymized data (anonymousOnly).

In this case, both the user inputs (prompts) and results from connected tools are automatically masked before processing by the AI model.

Why is there anonymization if nothing is permanently stored at the provider anyway?

Because Ayunis uses external LLMs. Anonymous mode prevents personal data from being transmitted to the external LLM provider. Regardless of this, data is stored exclusively with us and only processed, not stored, at the provider.

Are sensitive user inputs blocked?

No. Ayunis does not block user inputs on principle. Instead, the protection of sensitive data is ensured via technical and organizational mechanisms:

Anonymized models (anonymousOnly): AI models can be configured to work exclusively with anonymized data. When such models are used, masking is automatically enforced for all associated conversations; sensitive information is then processed exclusively in anonymized form.
Organization-specific exceptions (whitelist): Administrators can define that certain data categories or content are not anonymized (e.g. the name of their own organization). The exceptions are controlled via configurable rules based on certain data categories (PII – personal data) as well as optional patterns (e.g. regex).

How does the NER model behave with indirect personal data (e.g. “the data protection officer of the magistrate’s office”)? Are there additional safety mechanisms?

Indirect data is generally not anonymized; there is no 100% guarantee. The feature does not replace organizational measures or training. For more control, exceptions definable in the admin area (whitelist) are available, based on data categories (PII) and optional patterns (e.g. regex).

Can anonymized requests/documents be de-anonymized again (restored) – e.g. to send a response to citizens?

Yes. De-anonymization is possible. A document is only anonymized in the context of an anonymous chat, not per se.

Anonymous mode sometimes redacts too much (e.g. “10 m” or URLs are masked) – what can be done?

The mode tends to redact rather too much than too little. For more control, exceptions (whitelist) can be defined in the admin area; 100% accuracy is technically not possible.

Does the anonymization also apply to directly uploaded images/screenshots?

No. The filter only applies to text/documents (e.g. when a photo has previously been inserted into a Word document), not to directly uploaded images.

Can the anonymization be configured granularly per team (instead of only per organization)?

Currently, a single anonymization configuration applies to the entire organization. A team-granular configuration is not currently available.

Can the model be told that a certain abbreviation is not a name (incorrect redaction)?

Yes – via the exceptions/whitelist in the admin area. The rules are based on data categories (PII) and optional patterns (e.g. regex).

7. Logging & Audit

Is access logged? What is logged (content/metadata)? Who has access to logs? How long are they kept?

Only metadata is logged – e.g. how many messages are sent and which tools the AI used – no message content.
Access to logs is only held by Ayunis as the provider; no external logging service is used.
Retention: Logs are deleted after 90 days.

Data is only stored with us (DE); during the AI call, only the required data is transmitted, and nothing is stored at the provider. Customer accounts can be fully deleted; the storage duration can be configured in the account. The details are governed in the legal documents.

What precautions are taken with regard to the EU AI Act?

Ayunis Core is not a high-risk system, so there are no special requirements beyond the usual data protection/security requirements. The AI’s processes are made transparent, access to data/documents only takes place as specified by the user, and admins can restrict models.

Data is held at Ayunis (DE); chats and accounts can be deleted, and deletion periods can be configured in the account.

Can it be technically ensured (e.g. by IP restriction) that Ayunis Core is only used for official purposes or is only accessible via the administration/Citrix network?

An IP address restriction is possible in the admin settings under “Security”; a restriction to certain server/Citrix connections can be implemented. Private use cannot be completely prevented with this (e.g. in the home office).

Given the server location in Germany, is it unproblematic to also upload personal data for analysis?

The servers are located in Germany; for the request, the prompt is sent to the respective model endpoint, but processed there only transiently for inference, not stored. For particularly sensitive personal data, anonymous mode or an EU-hosted model is recommended.

For personal data, a chat with an EU-hosted model (e.g. Mistral) is recommended. Restricting a single skill to exactly one model is not currently available.

Is there a ready-made data protection skill that accesses the privacy terms?

No. Customers can implement this themselves by uploading the privacy terms into a chat or a knowledge base.

9. Legal Documents, Record of Processing Activities (Art. 30) & Liability

It is provided on specific request, not issued by default.

Where are liability provisions governed? (not found in the DPA)

Not in the DPA – liability is governed in the terms and conditions.

Can the legal topics or recurring data protection questions be bundled centrally?

The data-protection-relevant topics are bundled in our data protection concept, which is provided on request. Recurring questions and answers are collected centrally.

10. Web Search (Brave) & Data Protection

In the DPA, “Brave Software Inc.” (USA) is listed as a third-party provider for web search – are there data protection concerns?

With web search, only the search query goes to Brave (the same as what would otherwise be entered into Google) – the chat history stays with us and is not transmitted. On request, web search can be made deactivatable.