Data security
What happens to your clients' documents
Agencies sign NDAs and carry the liability. This is exactly where a scan goes, who can see it and when it is deleted, written as facts rather than reassurance.
6,000 free characters every month, no card. See three real scans translated
The path of a document
- Storage
- Files, the database and backups live with Hetzner Online GmbH in the European Union (Germany / Finland). Their data centres are ISO 27001 certified.
- Recognition and translation
- Page images (for recognition) and text (for translation and AI checks) are sent through OpenRouter to model providers with training switched off. OpenRouter is a US company, so this is a transfer outside the EU.
- Model training
- Your documents are not used to train models: neither by us nor by the model providers, who are selected with training disabled.
- Retention
- Auto-delete is on by default: 30 days after upload the document, its translation and the stored files are permanently removed. You can shorten, extend or turn this off. Deleting a document by hand removes it immediately.
- Who can see it
- Nobody on our side opens a document unless you ask support to, for example to reproduce a problem.
- In transit
- TLS 1.2+ on every connection. Passwords are stored as bcrypt hashes.
- Error monitoring
- Errors go to Sentry as metadata only: IDs, timings, status. Document content is not sent.
What we will not claim
- We have no ISO 27001 or SOC 2 certificate of our own. The certification belongs to the data centre.
- Text and page images leave the EU for recognition and translation. If your client forbids any transfer outside the EU, this tool is not for that client.
- There is no on-premise or air-gapped version.
The documents behind this page
Questions
Is there a data processing agreement?
Yes, the DPA is published and applies to every account. If your client needs a signed copy, write to us.
Can we delete everything at once?
Delete documents in the app, or email help@chatscontrol.com and we delete the account's data on request.
Where is the list of subprocessors?
On the subprocessors page, with the purpose and country of each one.
More for agencies
Put one of your own scans through it
A certificate, a diploma, a form with a table. You will see in two minutes whether it saves your team time.