Trust & Compliance

Every vertical we build on the talari.ai platform handles sensitive professional data — session notes from therapists, case files from lawyers, patient records from vets. Under the GDPR, much of this is special-category data (Art. 9), with stricter protections than ordinary personal data.

This page tells you, in concrete terms, where data lives, who can touch it, what we will do if something goes wrong, and which commitments are already in place versus on the roadmap.

If anything on this page is unclear, or if you need a copy of our DPA / AVV before signing, contact us at trust@talari.ai.

Audit trail. Once region-pinning is live, each request that touches sensitive professional data will be logged with the region of every component that handled it. Logs are retained per the retention schedule in our DPA / AVV.

KMS region-locality statement. No customer-content key is ever materialised, wrapped, or used by a service running outside the EU. This is enforced at the IAM and network layers as part of the region-pinning architecture.

We will not display badges for certifications we have not yet earned. When SOC 2 Type II is issued, the audit-firm name, attestation-period, and report-availability path will appear here.

We follow the GDPR Art. 33 / Art. 34 framework.

Entries marked live are in use. Entries marked pending are in use, but the Art. 28 data processing agreement (DPA; in German: AVV) with the provider is not yet concluded. Entries marked planned or proposed are not yet in use.

Registry state: 5 live · 3 pending · 1 planned · 4 proposed.

Notification SLA on changes. We will notify controllers at least 30 days before any new sub-processor begins processing customer-adjacent data, and at least 60 days before any change that affects the data-residency region.

We will not assert “we have a DPO” until the contract is executed. This page is updated within 5 business days of execution.

We do not treat the DPIA as a paperwork exercise filed once and forgotten. The talari.ai platform is built DPIA-first: every architectural decision that touches professional-session content is evaluated against a residual-risk register before merge.

The full DPIA (Art. 35 GDPR) is maintained internally and made available on request under NDA.

Headline findings from the v1 DPIA:

• No high-risk residuals requiring Art. 36 prior consultation with a supervisory authority.
• The single residual above Low is the quality risk that an AI-generated draft might be inaccurate — mitigated by the architectural commitment that the professional is always the author of record: no draft is filed without the professional's explicit review and approval.
• Lawful basis (Art. 6 / Art. 9):controller-side basis is the professional's service relationship and, where applicable, the client's explicit consent (Art. 9(2)(a) / Art. 9(2)(h)). Our processor-side activity is governed solely by the DPA / AVV — we do not process professional content for our own purposes.
• No secondary use.Professional-session content is never used to train, fine-tune, or evaluate any model — neither ours nor a sub-processor's. This is a contractual term with each LLM sub-processor and a hard architectural rule.

Zero US sub-processors handle raw customer-adjacent content.

This is a categorical commitment, not a best-effort statement.

• All AI inference (language models and speech-to-text) is performed by EU-headquartered providers in EU data centres (see §5). The terms of our main provider exclude training on customer data and exclude retention of requests after processing, except temporarily to investigate abuse or faults.
• All primary and secondary infrastructure is operated by EU-headquartered providers in EU data centres under EU jurisdiction.
• The US-headquartered services we use — payments (Stripe), transactional email (Namecheap) and bot protection on forms (Google reCAPTCHA) — do not receive session content and are covered by the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses.
• Where a US-headquartered tool offers an EU-data-residency tier, we use that tier in preference to a non-EU one, even at higher cost.
• We monitor adequacy decisions and Schrems-style litigation; if the EU–US Data Privacy Framework is invalidated again, the architectural commitment above means our professional-content data flow is unaffected.

• General trust questions: trust@talari.ai
• Co-build and partnership enquiries: build@talari.ai
• Subject-rights requests (Art. 15–22): trust@talari.ai (will route to dpo@talari.ai once the DPO firm is contracted)
• Security disclosure: security@talari.ai (PGP key published once the security mailbox is provisioned)
• Postal address: ul. Ignacego Paderewskiego 144A lok. 2, 04-443 Warszawa, Poland