Where your data is, who can access it, and what we never do

Your data stays in EU regions. We never use it to train AI models. Access is role-based, and nothing enters a system without a person's approval. We work under the GDPR, sign a data processing agreement, work to ISO 27001, ISO 27701, and ISO 42001, and build so that you are ready for the EU AI Act. Here is exactly what that means.

Route

Where your data goes

In practice

Region

Where your data is

Your data runs in one environment that we manage: our own servers in the Netherlands for our platforms and EU data centres for processing and AI models, always under our contracts and our access rules.

Layer	Where	Managed by
Your own systems	Stay where they are: workspace, storage, accounting	We connect; we take nothing over
Our platforms and the portal	Our own servers in the Netherlands	Kroon Optimi, managed and monitored
AI processing	EU regions, no training on your data	Under our contracts and our keys
Automations	In our managed environment or in yours	Logged, with an approval step

Which subprocessors we use for a project is in the data processing agreement you receive at the intake.

Excluded

What we never do

Use your data to train models. This is contractually excluded with every supplier we use.
Process data outside the EU without your explicit approval.
Sell, share, or reuse data for another client.
Put an automation into production without an approval step and logging.
Take more access than necessary. Read-only first; write access only where the flow requires it.

Access

Who can access it

Access follows the permissions you already have. In the AI workspace, an employee sees nothing they cannot already see in SharePoint or the case system. You can exclude confidential folders, HR files, and client groups. Our own access during a project is temporary, assigned by name, and revoked or handed over at delivery.

Control

Human approval

Every automation has an approval step. Green goes through. Orange is reviewed by a colleague who sees the original next to the result. Agents prepare work; they do not send, post, or change anything without approval. That is not temporary caution but the standard setup, a year on as well.

Standards we follow

Law

Data processing agreement for every project that processes personal data.
Register entry: for each flow, we record which personal data passes through it, for what purpose, and where.
DPIA: where the processing calls for it, we help with the data protection impact assessment.
Retention periods and logging: logs contain what is needed to trace an outcome, and no more.

Standard

ISO 27001, 27701, and 42001

We work to ISO 27001 (information security), ISO 27701 (privacy), ISO 27017 and ISO 27018 (cloud security and personal data in the cloud), and ISO 42001 (AI management system): risks named, access limited, changes logged, suppliers assessed, incidents reported. Want to see how we work? We will walk you through it.

Regulation

EU AI Act

For most applications at companies with 10 to 100 employees, the EU AI Act means three things: know which AI you use (a register), make sure your people can work with it (AI literacy, Article 4), and keep a person responsible. We classify each application by risk class, deliver the register and a one-page policy with it, and run the literacy session through our workshops. With Managed AI, we keep the register up to date.

Summary

RegionEU; one environment, managed by Kroon Optimi; subprocessors in the data processing agreement
TrainingNever on your data
AccessBy role, following existing permissions; our own access temporary and by name
ApprovalA person approves before every action
GDPRData processing agreement, register, DPIA support
StandardsISO 27001, 27701, 27017/27018, and 42001
EU AI ActRisk class per application, register, and AI literacy
OwnershipYou own the code, configuration, and documentation

Questions about a specific situation? Ask them during the intake. Your IT lead or accountant is welcome at the table.

Schedule a free intake.

Schedule a free intake