Security & trust

Your documents, processed in the EU and under control

Where data is processed, what is stored and for how long, how it is encrypted and who can access it. Everything your data protection officer usually asks, on one page.

Request the security documentation See the ENS certificate

Processing and AI in the EU
ENS (Spain) — MEDIUM category
GDPR compliant
Audit log without personal data

Where data is processed

The service runs on OVHcloud servers in Gravelines (France) and Warsaw (Poland), inside the European Union.
The detection AI is our own and runs on those same servers: documents are not sent to third-party AI services.
Hosting involves no international transfers outside the European Economic Area.

ENS and GDPR

Politeia Soft is certified under Spain’s National Security Framework (ENS), MEDIUM category (certificate ENS-2026/0141, issued by AENOR). Valid until 1 October 2028, with 68 measures and a medium level for confidentiality, integrity, traceability, authenticity and availability; its scope includes our Jerez de la Frontera office and the OVHcloud data centres in Gravelines and Warsaw.
Designed to comply with the GDPR and the Spanish LOPDGDD: data minimisation, storage limitation and security of processing (Art. 32).
When we process documents on behalf of your organisation, Politeia acts as a processor (Art. 28 GDPR) under the contract.
In the event of a personal data breach, the supervisory authority is notified within 72 hours where required.

What is stored and for how long

Instant anonymization: the document is processed in memory and not stored on the server.
Background queue: the original is deleted when the job finishes and the result when you download it.
Retention per group: group administrators can have documents and results deleted automatically after a number of days (1 to 365).
Version history: up to 10 versions per document, encrypted and without the file name.
The account is kept for the duration of the contract and billing data for the legal period (6 years in Spain).

Encryption

Connections encrypted with TLS 1.2 or higher, and encryption at rest on the provider’s infrastructure.
Pseudonymisation maps are stored encrypted with AES-256-GCM and a key specific to each group, and expire automatically.
Maps you download or send to the queue are protected with the password you choose, which is not stored.
Sign-in passwords are stored as BCrypt hashes.

Access and accounts

Two-step verification (2FA) with an email code or an authenticator app; your company can make it mandatory for all its users.
Single sign-on (SSO) via OpenID Connect with Microsoft Entra ID, Google Workspace or another OIDC provider, restricted to the company’s email domains and with optional automatic user creation (SAML is not supported).
Role-based permissions: who manages the group, who can de-anonymize and who has API keys.
Invitations expire after 7 days and every API key belongs to a specific user and group.

Audit log

Exportable log in CSV or PDF: date, user, operation, source (web, API or MCP), pages, document fingerprint and result.
It never stores document names or content: only their SHA-256 fingerprint.
It serves as evidence in ENS and ISO 27001 audits and also records deletions made by the retention policy.

Backing and certifications

ENS certificate, MEDIUM category
AENOR CONFIA, certificate ENS-2026/0141 (Royal Decree 311/2022), valid from 1 October 2026 to 1 October 2028.
View the certificate (PDF)Certificate details
Claude for Startups
Politeia Soft is a member of Anthropic’s startup program.
OVHcloud Startup Program
Politeia Soft is a member of OVHcloud’s startup program, where we host Anonimatum in the EU.

Sub-processors and data processing agreement

The main infrastructure is provided by OVHcloud (France and Poland, EU). The full list of sub-processors and the data processing agreement are provided to customers who request them when contracting.

Request the list and agreement

Learn more in GDPR Compliance · ENS Certification · Privacy Policy