Trust & Compliance
Version v1.5|Last updated: 2026-11-02|Effective: 2026-09-03
Where talari.ai (Talari AI Services P.S.A.) stands today — what is already in place, what is being built, and what is on the roadmap. Every commitment is scoped as Live, In progress, or Planned.
Registered operating entity. TALARI AI SERVICES PROSTA SPÓŁKA AKCYJNA is registered in the Polish National Court Register (KRS) under number 0001264352, kept by the Sąd Rejonowy dla m.st. Warszawy w Warszawie, XIV Wydział Gospodarczy Krajowego Rejestru Sądowego (District Court for the Capital City of Warsaw, 14th Commercial Division of the National Court Register). Contact trust@talari.ai if you need our current DPA / AVV before signing.
Why this page exists
Every vertical we build on the talari.ai platform handles sensitive professional data — session notes from therapists, case files from lawyers, patient records from vets. Under the GDPR, much of this is special-category data (Art. 9), with stricter protections than ordinary personal data.
This page tells you, in concrete terms, where data lives, who can touch it, what we will do if something goes wrong, and which commitments are already in place versus on the roadmap.
If anything on this page is unclear, or if you need a copy of our DPA / AVV before signing, contact us at trust@talari.ai.
1. Data location — EU-only, DE primary
| Item | State | Detail |
|---|---|---|
| Primary processing region | Live | Germany. Production runs on Hetzner servers in Germany. |
| AI processing (language models, speech-to-text) | Live | EU only. Scaleway (France). Backup speech-to-text: OVHcloud (France), only when Scaleway is unavailable. Backup language models, relevance ranking and search embeddings: IONOS (Germany), only when the primary service is unavailable. Relevance ranking currently runs at apertus.ai (Germany) and is moving to Berget AI (Sweden). |
| Secondary / disaster-recovery region | In progress | Germany or France. IONOS (DE) or OVHcloud (FR) under evaluation for disaster-recovery hosting (separate from their AI backup role in §5). EU jurisdiction in either case. |
| Customer-content data centre outside the EU | Never | Architectural commitment, enforced via region-pinning and audit logging. |
| Customer-content data flow to a US sub-processor | Never | See §8 (Schrems II). |
| Marketing / website analytics | In progress | EU-resident, cookie-light analytics only; vendor pin pending. No US analytics for any page that handles authenticated session data. |
Audit trail. Once region-pinning is live, each request that touches sensitive professional data will be logged with the region of every component that handled it. Logs are retained per the retention schedule in our DPA / AVV.
2. Encryption
| Item | State | Detail |
|---|---|---|
| In transit | In progress | TLS 1.3, modern cipher suites only, HSTS preload. End-to-end from client to application tier. |
| At rest — application data | In progress | AES-256 disk-level encryption on all primary and replica storage. |
| At rest — sensitive fields | In progress | Field-level envelope encryption on top of disk-level for any field carrying professional session content. |
| Key management | In progress | Customer-content keys held in a managed KMS pinned to an EU region (Hetzner-EU or IONOS-EU). No key material crosses the EU border. |
| Backups | In progress | Encrypted at rest with the same EU-region key hierarchy. Backups never replicated outside the EU. |
KMS region-locality statement. No customer-content key is ever materialised, wrapped, or used by a service running outside the EU. This is enforced at the IAM and network layers as part of the region-pinning architecture.
3. Audit status
| Item | State | Detail |
|---|---|---|
| ISO 27001 / ISO 27701 | Planned | Decision deferred until SOC 2 readiness completes. |
| SOC 2 Type II | In progress | Audit-firm RFP scheduled for Phase 3 readiness (target 2026-Q3 if the budget gate is open). EU-resident or regulated-industries firm preferred. Report shared on request once issued. |
| Independent penetration test | In progress | Annual external pen test scoped under our security roadmap. Summary letter shareable under NDA. |
4. Incident response
We follow the GDPR Art. 33 / Art. 34 framework.
| Item | State | Detail |
|---|---|---|
| Notification SLA to controller | In progress | Within 24 hours of a confirmed incident, by the channel agreed in the DPA / AVV. This is stricter than Art. 33's 72-hour controller-to-supervisory-authority deadline. |
| Notification path to supervisory authority | In progress | The controller files; we provide the technical breach report needed for the filing. Default targets: BfDI / Berlin LDA (DE), UODO (PL). |
| Tabletop exercise | In progress | First exercise scoped under our security roadmap; documented residual-risk register. |
| Status communication | In progress | Status page at status.talari.ai — planned; not yet live. |
5. Sub-processor list
Entries marked live are in use. Entries marked pending are in use, but the Art. 28 data processing agreement (DPA; in German: AVV) with the provider is not yet concluded. Entries marked planned or proposed are not yet in use.
| Sub-processor | Purpose | Region | Status |
|---|---|---|---|
| Hetzner Online GmbH | Primary infrastructure (compute, storage, network) — professional content + metadata | DE (Falkenstein / Nuremberg) | Pending In use; DPA / AVV not yet concluded |
| Hetzner Online GmbH (FI node) | CRM platform hosting (self-hosted EspoCRM) — prospect/controller data only, no professional content | FI (Helsinki) | Pending AVV annex drafted; awaiting signature |
| IONOS SE | Backup AI language models (pseudonymised text), relevance ranking (search query and retrieved passages) and search embeddings (search query text), used only when the primary service is unavailable | DE (Berlin) | Live Since 2026-10-30; DPA in the IONOS standard contract |
| OVHcloud SAS | Backup speech-to-text (session audio), used only when Scaleway is unavailable | FR (Gravelines) | Live Since 2026-10-30; provider DPA in place |
| Scaleway SAS | AI language models (pseudonymised text) and speech-to-text (session audio) | FR (Paris) | Live Provider DPA in place |
| Flynnt UG (apertus.ai) | Relevance ranking of retrieved document passages | DE | Pending In use; DPA not yet concluded; to be replaced by Berget AI |
| Berget AI AB | Second EU AI provider; relevance ranking | SE (Stockholm) | Planned Not yet in use |
| Stripe, Inc. | Payments and subscription billing — billing data only, no session content | US | Live |
| Namecheap Inc. (Private Email) | Transactional email (account lifecycle) — no session content | US | Live |
| Google (reCAPTCHA) | Bot protection on sign-up and application forms — no session content | IE / US | Live |
| Telegram (Bot API) | Optional messaging integration | AE | Live Only if enabled by the customer |
| Error monitoring | Application-error telemetry (no professional content payloads) | EU | Proposed |
Registry state: 7 live · 3 pending · 1 planned · 1 proposed.
Notification SLA on changes. We will notify controllers at least 30 days before any new sub-processor begins processing customer-adjacent data, and at least 60 days before any change that affects the data-residency region.
6. Data Protection Officer
| Item | State | Detail |
|---|---|---|
| Art. 37 assessment | Live | Documented on 20 October 2026. Processing personal data on behalf of our customers, including health data for therapists, is our core activity, but at our current volume it is not processing “on a large scale” within the meaning of Art. 37(1)(c) GDPR, so designating a DPO is not mandatory under the GDPR at present. We repeat the assessment every quarter. |
| Data-protection contact | Live | trust@talari.ai handles every data-protection question and data-subject request. |
| External DPO | Planned | We will designate an external DPO, notify UODO (the Polish supervisory authority) and publish the contact here when our processing approaches a large scale, when a hospital or clinic-chain customer joins, or when the law otherwise requires it. |
We have not designated a Data Protection Officer within the meaning of Art. 37 GDPR. This page is updated within 5 business days of a designation.
7. DPIA-by-design summary
The talari.ai platform is built DPIA-first: every architectural decision that touches professional-session content is evaluated against a residual-risk register before merge.
The full DPIA (Art. 35 GDPR) is maintained internally and made available on request under NDA.
Headline findings from the v1 DPIA:
- No high-risk residuals requiring Art. 36 prior consultation with a supervisory authority.
- The single residual above Low is the quality risk that an AI-generated draft might be inaccurate — mitigated by the architectural commitment that the professional is always the author of record: no draft is filed without the professional's explicit review and approval.
- Lawful basis (Art. 6 / Art. 9):controller-side basis is the professional's service relationship and, where applicable, the client's explicit consent (Art. 9(2)(a) / Art. 9(2)(h)). Our processor-side activity is governed solely by the DPA / AVV — we do not process professional content for our own purposes.
- No secondary use.Professional-session content is never used to train, fine-tune, or evaluate any model — neither ours nor a sub-processor's. This is a contractual term with each LLM sub-processor and a hard architectural rule.
8. Schrems II statement
Zero US sub-processors handle raw customer-adjacent content.
- All AI inference (language models and speech-to-text) is performed by EU-headquartered providers in EU data centres (see §5). The terms of our main provider exclude training on customer data and exclude retention of requests after processing, except for at most 14 days, in France, to investigate abuse or faults.
- All primary and secondary infrastructure is operated by EU-headquartered providers in EU data centres under EU jurisdiction.
- The US-headquartered services we use — payments (Stripe), transactional email (Namecheap) and bot protection on forms (Google reCAPTCHA) — do not receive session content and are covered by the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses.
- Where a US-headquartered tool offers an EU-data-residency tier, we use that tier in preference to a non-EU one, even at higher cost.
- We monitor adequacy decisions and Schrems-style litigation; if the EU–US Data Privacy Framework is invalidated again, the architectural commitment above means our professional-content data flow is unaffected.
9. Contact
- General trust questions: trust@talari.ai
- Co-build and partnership enquiries: build@talari.ai
- Subject-rights requests (Art. 15–22): trust@talari.ai
- Security disclosure: security@talari.ai (PGP key published once the security mailbox is provisioned)
- Postal address: ul. Ignacego Paderewskiego 144A lok. 2, 04-438 Warszawa, Poland
10. Revision history
| Revision | Date | Change |
|---|---|---|
| v1.5 | 2026-11-02 | §8: our main AI provider (Scaleway) confirmed in writing that it keeps a request for at most 14 days, in France, and only to investigate abuse or faults. |
| v1.4 | 2026-10-30 | OVHcloud SAS (France) added as a live sub-processor: backup speech-to-text, used only when Scaleway is unavailable. IONOS SE (Germany) added as a live sub-processor: backup AI language models, relevance ranking and search embeddings, used only when the primary service is unavailable. Registry state updated. |
| v1.3 | 2026-10-20 | §6 rewritten after our Art. 37 assessment: no DPO is designated, the reasons, the data-protection contact, and when we will designate one. Removed the external DPO firm from the sub-processor list. |
| v1.2 | 2026-10-11 | Sub-processor list updated to the providers actually in use (Hetzner, Scaleway, apertus.ai, Stripe, Namecheap, Google reCAPTCHA) and planned (Berget AI); the LLM providers that were only proposed were removed. Data location and Schrems II statement updated accordingly. |
| v1.1 (draft) | 2026-05-25 | Aligned sub-processor list, DPIA summary, Schrems II statement, and contact section with psychotherapy.talari.ai Trust page v1.1. Same legal entity — same factual commitments. Added §7 DPIA-by-design summary. |
| v1.0 (draft) | 2026-05-25 | First public draft of the talari.ai platform Trust page. Adapted from the psychotherapy.talari.ai Trust page. Pre-incorporation framing — the operating entity was not yet registered at the time of that revision. |