Security and data: what happens to your company's data

Your company’s data stays in the European Union: the database, the server and the document search. The model that writes the answer runs in the US. This page says where each piece lives, who else processes it, what we hide before it reaches a model, who sees what, and what we don’t have yet. Where a provider has its own policy, we point to it; the exact list, with the legal basis for each transfer, is in the application’s privacy policy.

Where the data lives

The original documents

They stay where they are: in Google Drive, OneDrive, SharePoint, in email or in their own app. Temiro reads from them.

What Temiro keeps

The text indexed for search, the knowledge map compiled from it, and the conversations.

The database

Supabase, in the eu-west-1 region, Ireland: the indexed text, the conversations, the accounts and the files generated in chat.

The application server

Railway, in the EU West region, Amsterdam.

The application's interface

Vercel. The server functions run in Dublin; requests come in through Vercel's global network, at the point nearest to whoever opens the app.

The application's emails

Invitations, password resets and alerts go out through Resend. Account data, message metadata and logs are kept by Resend in the United States [5].

Keeping companies apart

Every row in the database and every search carries the company it belongs to. One company does not see another's data.

What leaves the European Union: the models that write the answer, Claude by default and GPT only on request, run in the US, as does the code sandbox; web search queries reach the search provider; the application’s emails go through Resend, in the US. That is why we do not say the data never leaves the European Union.

What reaches the AI models

To answer, the assistant sends the model the question, the document passages it found and the conversation so far. The calls go through the API, from Temiro’s own accounts by default. Claude, the default model, runs in the US; document search runs in the European Economic Area, through MongoDB Atlas.

Anthropic (Claude)

The default model. It runs on Anthropic's API, in the US, under the standard contractual clauses; the code sandbox runs there too, from the moment the assistant runs code in an answer. Anthropic does not train models on content sent through the API [1] and deletes inputs and outputs within 30 days at most; content its systems flag for breaking the usage policy may be kept for up to 2 years [2].

Claude, through Google Cloud

In preparation. Claude through Google Cloud Vertex AI, in the EU multi-region, where processing stays within the Union's member states [6]; Google does not use the data to train models without the customer's permission [7]. We switch it on for a company once Google approves our capacity.

OpenAI (GPT)

Switched on on request, and runs in the US. Since 1 March 2023, data sent through the API is not used for training without the customer's consent; abuse-monitoring logs are kept for up to 30 days [3].

MongoDB Atlas (Voyage AI)

Turns text into vectors for search and ranks the results, on MongoDB's EU endpoint: the content sent is processed in the European Economic Area, and what is kept in logs stays there too [4]. On Temiro's account, using the data to improve the models is switched off.

If the company allows it, a person can link Temiro to Claude, ChatGPT or Cursor. What that app then reads from Temiro reaches its provider, in the US, under the person’s account and that account’s terms; which is why we recommend company accounts. The connection only reads, and sees only what the person may see in Temiro.

What we hide before the model

Romanian national ID numbers (CNP), IBANs, card numbers and API keys are detected and hidden before indexing and in the messages written in chat, including the text of attached files. Email addresses and phone numbers are not hidden: most of the time they are the very thing being looked for. Detection is automatic and is not certain to catch everything.

Who sees what

A folder from Google Drive, OneDrive or SharePoint is seen in Temiro by exactly the people Drive gives access to it. Permissions are read per folder, by email address, on every sync; Google groups and link sharing do not count. Subfolders that should stay out are left out when you pick the folder. Other sources are connected at one level: the company’s, a team’s, or private. The assistant sees only what the person asking can see; the rule is enforced in the database, not only in the interface.

Temiro does not take on each file’s own permissions: a file in a connected folder is seen by everyone who sees the folder, so a more restricted document goes in another folder. Someone who loses access in Drive no longer sees the folder after the next sync; someone removed from a team no longer sees its sources, and someone removed from the company has no access at all.

As the platform’s provider, we have technical access to the hosted data. What limits it is the contract: the confidentiality agreement and the data processing agreement are signed before the first source is connected.

Nothing changes without a person

The assistant changes nothing on its own. Any creation, change or deletion in Drive, OneDrive or the calendar, and any email draft, shows up as a proposal, and a person presses “Approve”. Sending email does not exist in the product. The company’s own tools ask for approval by default; an administrator can exempt a specific one.

Tasks the company schedules run without confirmation at each step, because their instruction is the approval. Every action they take is logged.

The audit log

Every settings change and every tool the assistant calls is recorded, with who and when. An administrator can read it at any time. Entries are deleted automatically after 12 months.

How long we keep it, and how it is deleted

Indexed documents and conversations stay until you delete them or until the contract ends. Deleting a source, a Drive or OneDrive folder or a connector, also deletes the text indexed from it and the pages compiled from it. Disconnecting the Google or Microsoft account only stops the sync: what was indexed stays until you delete the sources. Short passages already quoted in conversations stay until those conversations are deleted. The data of a free trial that does not continue is deleted automatically 30 days after it ends.

Everyone can download their data from the app, as JSON, and their conversations, as Markdown, and can delete their account. The company’s corpus exports on request, in open formats. When the contract ends, the company chooses: we return its data or delete it, completely, files included. The deadlines for both are in the data processing agreement.

What we don’t have

We hold no certifications of our own, such as ISO 27001 or SOC 2. Our infrastructure providers have their own attestations, which we make available on request. How the answers hold up, with the mistakes found, is on the proof page; the state of the service, on the status page.

Sources

Read on 18 October 2026

1. [1] Anthropic, Commercial Terms of Service — “Anthropic may not train models on Customer Content from Services”
2. [2] Anthropic Privacy Center, How long do you store my organization's data?
3. [3] OpenAI, Your data
4. [4] MongoDB, Geographies and Designated Services in Atlas — “Atlas processes the content that you submit inside that Geography”
5. [5] Resend, Domain regions — “stored in the United States regardless of the sending region”
6. [6] Google Cloud, Data residency (Vertex AI) — “ML processing stays within that specific geographical region”
7. [7] Google Cloud, Gemini Enterprise Agent Platform and zero data retention — “Google won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction”