Frequently asked questions
Short answers on hosting, compliance, AI, and contacts.
How is customer data isolated?
Each workspace belongs to one organisation. Only signed-in members with the right role can access it. Exports and deletions are logged.
Where is my data stored?
Core workspace and account data is hosted in the EU. Standard AI, voice, and default web search use EU regions — see Subprocessors.
Who can access my data?
Your users, according to workspace roles. AUVY staff have limited access for support and operations. Owners can export or delete data; those actions are logged.
How is data encrypted?
Connections use modern TLS. Data at rest is encrypted. Documents and connected-account secrets get additional protection.
What are your retention periods?
You can export workspace content anytime. After the contract ends, we delete on the timelines in the data processing agreement and privacy notice (typically 30 days for workspace content). Activity logs are kept about 12 months. Billing records follow the law.
What GDPR documentation does AUVY provide?
AUVY publishes a binding standard AVV for B2B self-serve, an English courtesy translation, a privacy notice, technical measures, and a live processor register. These materials support customer review without claiming counsel certification or blanket compliance for every customer use. Privacy requests: privacy@auvy.ai.
What does the §203 badge mean?
Support for German professional secrecy (§ 203 StGB) is available for Enterprise under our data processing agreement. It must be activated in writing. Until then, that kind of confidential data must not be processed in AUVY.
What certifications does AUVY have?
SOC 2 Type II and ISO 27001 are in progress. We do not claim certifications we have not received. The AVV and GDPR documentation are public now.
Why does connecting Microsoft 365 need an admin, but Sign in with Microsoft does not?
Sign in with Microsoft uses the AUVY identity app and only asks for who you are. Connecting Outlook, Teams, or SharePoint uses AUVY Keyring and needs a one-time Microsoft 365 admin approval in company directories. After that, each person still signs in with their own account. AUVY acts only as that user.
How does AUVY use AI with my data?
For each request AUVY sends the context needed for that turn to the selected provider and writes results back to the workspace. AUVY does not train models on customer data. Article 50 duties are role-specific; AI interaction is disclosed where required, while provenance marks can be degraded downstream and do not guarantee accuracy.
How is voice transcription handled?
Voice features use Microsoft Azure speech in Azure EU (Sweden). Details are on the Subprocessors page.
How is web search handled?
Linkup in the EU is the default web-search and page-fetch path. Only data needed for the active request is sent.
Which terms apply to me — business or consumer?
Business customers use the business terms; consumers use the consumer terms. Both are listed under Resources.
Who do I contact?
Security: security@auvy.ai. Privacy: privacy@auvy.ai. Support: support@auvy.ai.