Everything your IT and legal teams will ask
Who owns your data, where it's held, what we will never do with it, and where we are on security certification.
We only act on your instructions.
And Anthropic doesn't train on data sent through its API.
Your data is walled off from every other customer at the database.
A handover window to take your passports elsewhere, with a full export and our help.
The detail
You do. We hold a copy to build and serve your passports and pods, and act only on your instructions.
You do. Where they include personal data, you are the controller and we are the processor under UK and EU GDPR.
No. Every query is limited to your account at the database, and automated tests check that this isolation holds.
In the United States. Our data processing agreement, including how transfers out of the UK and EU are covered, is being finalised. Ask us for the current position.
No. Anthropic does not train on data sent through its API.
Every question and answer is logged, so you can see exactly what the pod said. It's set up to answer only from your product data, and when something isn't there, it says so rather than guessing.
Your passports stay online and read-only for twelve months, a handover window to move them to your own domain or another provider, with a full export and our help migrating. After that we keep them online for a small yearly fee, for as long as the law requires, until you move or retire them.
They're kept while you're a customer and deleted within 30 days of your contract ending. We can delete them sooner if you ask.
Yes. Passports on talkpod.ai keep working while you're a customer and through the twelve-month handover window after, which gives you time to move them to your own domain or another provider.
We tell you without undue delay, so you can meet your own 72-hour reporting duty under GDPR, with what happened, what data was involved and what you need to do.
Yes, at any time, across every provider we use. We confirm it in writing.
Who else touches your data
If this list changes, customers get 30 days' notice.
What we're certified for, and what's next
A processor under UK and EU GDPR, with our subprocessors published. Our DPA is being finalised.
Cyber Essentials Plus, a first external penetration test, and personal data removed from conversation logs automatically.
SOC 2, when an enterprise contract needs it.
Send us your questionnaire
Or ask for our subprocessor list and the current state of our data terms.