Where data is stored and who processes it
This page is for data protection officers and IT managers. It has the main facts from the data processing agreement: where data is, how long it is kept and where the exceptions are.
- Server in Finland
- AI models in the EU
- No training
- Agreement before work
How data flows
1. Sign-in
Staff sign in with the institution's Microsoft or Google account. Etekos stores no passwords. The institution's account administrator decides who may sign in.
2. Server in Finland
Chats, files and user profiles are stored on the Etekos server in a data centre in Finland. The connection to the browser is always encrypted (HTTPS).
3. AI model in the EU
To prepare an answer, the server sends the question and the needed part of the chat to an AI model in an EU data centre. It is processed only in EU member states.
4. Backups
Every night an encrypted backup goes to a separate data centre in another EU country. Etekos encrypts it before sending, and only Etekos has the key.
Features the institution turns on itself
These are off by default. They are turned on only after the institution's written consent.
Web search
A search service in the EU receives only the search words, without the user's name, e-mail or the chat. If it cannot find results itself, the search words may go to its fallback search provider in the US. The platform does not send search words that contain an e-mail address or a personal code.
Design tool
Each staff member signs in to their own design tool account. The tool receives only the design description. Its provider may process data outside the EU.
Retention
- Chats and files: up to 12 months. Users can delete their own chats at any time.
- Backups: 30 days.
- After the contract ends: 30 days for data export, then the data is deleted from the platform. Together with backups, the data is gone no later than 60 days after the contract ends, earlier on request.
Who can see chats
The user
Sees only their own chats and files.
The institution's administrator
Sees total usage and limits. Does not see chat content and does not see each person's usage.
Etekos
Accesses the server only for maintenance and incidents. Does not read chat content unless the institution or the law requires it.
Security measures
- Every institution has its own search database, its own file storage data and its own budget.
- Admin tools are not reachable from the internet.
- Sign-in only through the institution's account. Accounts are never linked automatically.
- Every user and the whole institution have a cost limit that cannot be exceeded.
- Etekos reports a personal data breach to the institution within 24 hours, so the institution can meet the GDPR 72-hour deadline.
Frequently asked questions
Are chats used for AI training?
No. Neither Etekos nor the AI model provider uses customers' chats and files to train models. This is written in the data processing agreement.
Who are the sub-processors?
The full list with companies, countries and data types is in annex 2 of the data processing agreement, which the institution receives before signing. We notify the institution in advance of any change to the list.
Where is the server?
In a data centre in Finland. Backups are stored in a separate data centre in another EU country.
What if a staff member entered personal data by mistake?
They can delete the chat themselves. If needed, the institution can ask Etekos to delete it from backups too, and we confirm it in writing.
Etekos AI
AI chat for staff in Latvian and English: popular AI models, EU data, Microsoft or Google sign-in, a data processing agreement. From €7 per user a month.