Your documents stay yours: security, EU hosting and AI provider control
Responsemate is purpose-built for teams handling sensitive security and compliance documentation. Here is how we approach data protection and responsible AI processing.
Danish company · EU-region data hosting
GDPR-Focused
Responsemate is operated by a Danish company and is designed to support GDPR-conscious teams. For customer workspace data, you remain the data controller and we act as the data processor under a Data Processing Agreement.
EU Data Hosting
Customer workspace data is stored in EU-region cloud infrastructure. Where approved sub-processors process data outside the EU or EEA, we use contractual safeguards such as Standard Contractual Clauses.
No AI Training on Your Data
Your documents, questionnaires, and answers are not used to train AI models. Your knowledge base is processed only to generate responses and recommendations for your workspace.
Protected in Storage & Transit
Customer data is protected by cloud storage controls and encrypted connections in transit. Access to production systems is limited to authorised personnel.
Live uptime and incident history: View status page →
How we handle your data
What we store
We store the files you upload to your knowledge base, the questionnaires you import, the AI-generated and human-edited answers your team produces, and account or invoicing information where applicable. We do not store payment card numbers.
How long we keep it
Your data is retained for as long as your account is active or as otherwise agreed in your contract. You can request deletion by contacting mail@responsemate.dk.
Who can access it
Only users in your workspace can access workspace data through the product. Responsemate staff access customer data only when needed for support, operations, or incident response and under confidentiality obligations.
How AI processes your content
When you run a questionnaire, relevant excerpts from your knowledge base may be sent to configured large language model APIs to generate answers. We use AI providers under business/API terms and data processing agreements intended to prevent customer content from being used for model training.
What the AI may change on its own
Nothing. Drafts are drafts until a person approves them, and only approved answers are exported. When the AI assistant is asked to act, it shows a proposal that names what will change; the change happens after you confirm, and most can be undone from the same reply. Everything Responsemate does on its own, such as the nightly knowledge scan, is marked as system activity in the history.
AI compliance and provider control
Responsemate is built for regulated teams that need control over how AI is configured, reviewed, and documented. Our approach is LLM provider agnostic and designed to support responsible, AI Act compliant workflows.
Not tied to one AI provider
Responsemate runs on the language model provider you pick, so your workspace is not locked to one vendor. Every AI call is logged for your admins: what was asked, what came back, which model, and how long it took.
Bring your own AI keys
An admin can connect your own API keys for OpenAI, Anthropic, Azure OpenAI, Google, Mistral or Amazon Bedrock. Keys are stored encrypted, the usage runs on your account and under your contract with the provider, and a different model can be chosen for drafting, chat, reading imports and upkeep.
Designed for AI Act compliant use
Responsemate helps teams keep humans in the loop, review AI-generated answers before use, and maintain source-based context for generated responses. These controls are designed to support internal AI governance and EU AI Act compliance obligations.
Transparent, reviewable outputs
AI output is treated as a draft for expert review, not an automatic final answer. Teams can edit, approve, and reuse responses with the relevant knowledge base context visible during the workflow.
Sub-processors
We use third-party sub-processors to deliver the service. Customer content is handled under provider terms and agreements intended to limit use to providing the contracted service. The full sub-processor list with addresses and assurance, and the Data Processing Agreement it belongs to, are published here.
| Sub-processor | Purpose | Data location | Notes |
|---|---|---|---|
| DigitalOcean | Application hosting and job queue | Amsterdam, the Netherlands | Every request to the platform passes through these servers. |
| Cloudflare | DigitalOcean's content-delivery and TLS edge, engaged by DigitalOcean | EU points of presence for EU visitors; a US company | Every request passes through it in transit before it reaches the application. It stores no content and sets one strictly necessary cookie. |
| MongoDB Atlas | Database and backups | Stockholm, Sweden | Accounts, knowledge base text, questionnaires and answers, activity and AI logs. |
| Amazon Web Services | File storage and text recognition of scanned documents | Stockholm, Sweden and Dublin, Ireland | Uploaded files stay in the EU. |
| OpenAI | Fallback AI provider, used only by a workspace that has not connected an AI provider of its own: drafts, summaries, search embeddings, chat replies and the transcription of dictated voice input | Transient processing in the USA; nothing kept beyond abuse monitoring of up to 30 days. The workspace's content stays in the EU. | Only the excerpts needed for a request leave the EU, for the time it takes to answer; they are not used for model training and not kept beyond abuse monitoring. Covered by the EU-US Data Privacy Framework and Standard Contractual Clauses. A workspace that connects its own key with the provider of its choice, including EU-hosted ones, never uses it. |
| Scaleway | Invitation and password-reset emails | Paris, France | Receives the recipient's name and email address only. |
| Sentry | Error monitoring | Frankfurt, Germany | An error report carries the account id, the workspace name and the page address, never the name or email address. Session replays mask all text. The monitoring script is served from the platform itself. |
The full list with addresses is Appendix B of our Data Processing Agreement, available to every business customer on request. Customers are told at least 30 days before a sub-processor is added or replaced. Integrations a customer switches on itself, such as Microsoft single sign-on, SharePoint or Slack, run under the customer's own agreement with that provider.
Last updated: 16 October 2026