Trust: what you need to approve EuroWork

This page isn’t written for the person who will use EuroWork. It’s written for the person who needs to approve someone else using it: the data protection officer, the IT manager, the procurement officer, or the person who gets the question dropped in their lap on a Friday and needs an answer by Monday.

We’ve tried to answer all those things in one place, including what we don’t have.

Where the data actually is stored

The database and the application both run in Frankfurt, in the same data centre region. AI processing happens by default with Mistral AI in Europe, with zero data retention: your questions and answers aren’t saved by the AI provider and aren’t used to train their models.

ChatGPT and Claude are available as options and involve processing in the US. They’re only used when an individual user actively selects them for a single message, and your administrator can turn the option off completely. Before such a message is sent, it goes through a sensitivity check, and anything that looks like personal data or confidential information is always routed to the EU model instead.

All of this is also stated in the policy document, which is the legally binding text. This page is the summary.

How one organisation never sees another’s data

The isolation is built into the database, not the code on top. Every query to the database carries the organisation’s identity, and without that identity, no rows are returned at all. If a bug in the application forgets a condition, the result is that nothing shows up, not that the wrong thing does. That’s called fail-closed, and it’s the only kind of protection you can rely on in the long run.

Content is never logged in the decision log. It records which model responded, when, how much it cost, and why the model was chosen. Not what anyone asked.

The contract

The data processing agreement is part of the service agreement, with your organisation as the data controller and EuroWork AB as the processor for the content your employees enter. You can get the contract text before you register, just let us know.

The sub-processors, meaning the providers we in turn use for operations and AI processing, are named in the policy document. If we change any of them, we’ll let you know in advance.

What we don’t have

We’re not ISO 27001 certified. We don’t have an external penetration test to show you, or a status page with an uptime history. Those things are coming, but we won’t pretend they already exist.

We’d rather you find this out on our own page than during a procurement process.

Accessibility

The service is built to meet WCAG 2.2 AA. Contrast levels, keyboard navigation, and screen reader support have been reviewed, but we’re not claiming every surface is perfect. If you run into something that doesn’t work, let us know, and we’ll fix it. That’s also the only honest way to work with accessibility: a service is never finished, it just gets gradually less bad.

If something goes wrong

If we discover a personal data breach, we’ll contact you without undue delay, with what we know at the time and what we’re doing about it. You’ll get what you need for your own report to the supervisory authority, including timestamps and which categories of data were affected.

Taking your material with you

Documents can be downloaded as Word, Excel, or PowerPoint directly in the service. If you want everything exported at once, for example because you’re choosing to leave, we’ll arrange that. We don’t see making a cancellation difficult as a negotiating position.

The AI Act

Everything the service generates is labelled. Images carry the marking inside the file itself, so it stays with the image when it’s downloaded and shared. AI responses are marked in the interface. That meets Article 50 on transparency, and the reports in the service can be used as part of your own documentation.

Ready-made template for a data protection impact assessment

If a public sector organisation is introducing AI, a data protection impact assessment is usually required, and writing one from scratch takes an afternoon no one has. Here’s a template where we’ve answered everything that’s about us. What’s left is what’s about you, and only you can answer that.

1. Description of the processing. EuroWork is used by employees to ask questions, summarise and create documents, transcribe meetings, translate files, and run recurring tasks. The data processed includes account details and the work content employees enter themselves.

2. Purpose and legal basis. Fill in your purpose. The legal basis is typically public interest or exercise of official authority for public sector organisations, legitimate interest for private ones.

3. Categories of data subjects. Employees who use the service, and the individuals who appear in the material employees choose to enter. Specify who these are in your organisation.

4. Necessity and proportionality. The service doesn’t collect more than what the employee writes or uploads themselves. The connection to Microsoft 365 is personal and voluntary: each user connects their own account, the connection is read-only (calendar, email headers, individual emails and files at the user’s explicit request), data is fetched at the time of the query without ongoing synchronisation, each access is logged, and the user can disconnect their account at any time.

5. Where the processing takes place. Storage within the EU and EEA: database and application in Frankfurt, in the same data centre region. AI processing with a European provider with zero data retention. Third-country transfers only occur if a user actively chooses an external model, an option that can be disabled for the entire organisation.

6. Risks and safeguards. Row-level isolation per organisation that fails closed, automatic sensitivity checks that can raise but never lower the protection level, information classification per query, an audit log of actions, human approval before an AI draft becomes a final document, and a monthly cost cap.

7. Residual risk. The main residual risk is that an employee enters more sensitive material than the purpose requires. Countermeasures: information classification, the sensitivity check, and the built-in course covering this specifically. Assess the level based on your organisation.

8. Consultation with the data protection officer. Fill in the date and any comments.

If you’d like this template as a Word document, just let us know and we’ll send it.

Ask us instead of guessing

If you can’t find the answer here, write to us. You’ll get a reply from a human, and if the answer is that we don’t have what you need, we’ll say so.