Using AI safely.Security by design, from hosting to every AI action.
Your data is stored in Google Cloud in Belgium, encrypted in transit and at rest. Access runs through roles and permissions, AI agents act within your users' rights and every action lands in an audit trail. We test the security of the Awen platform we build on ourselves, with internal security tests.
Security diagram: data in Google Cloud in Belgium inside the Awen platform with roles and permissions, encryption, backups and internal security tests. An AI agent acts within the user's rights, asks for approval and sends only the needed context to a language model that does not train on it. Every action lands in the audit trail.
Infrastructure: where your data lives.
In Google Cloud, in the Belgium region. Encrypted in transit and at rest, with automatic backups. We test the security of the platform internally.
01
Hosted in Belgium
Google Cloud, Belgium region. Your data is stored in the EU.
02
Encryption
TLS in transit and AES 256 at rest.
03
Backups
Automatic backups, so your data stays recoverable.
04
Internal security tests
We test the security of the Awen platform ourselves, with internal security tests.
AI models: what they get to see of your data.
A language model never gets your whole database. Each task sends only the context it needs.
Data minimisation per task
A model only gets the data it needs for that one task, such as the text of an email. Never more than the user is allowed to see.
Anthropic, OpenAI and Google Gemini
Anthropic and OpenAI through their business API, Gemini through Vertex AI in Google Cloud. Data sent through these services is not used to train models. Anthropic and OpenAI delete API data by default within 30 days. Processing by the model can happen outside the EU.
Open source models for sensitive data
When data may not leave your environment or the EU, we use an open source model, without an external model provider.
You know which model runs where
Per application we document which model is used and which data it receives.
Access and control: least privilege, for AI too.
Who sees and does what is set per role. AI agents follow the same rules, and every action can be traced afterwards.
- Roles and permissions (RBAC)Per role and per user you decide what someone sees and does.
- Agents within user permissionsAn AI agent always acts with the permissions of the user it works for and never sees more.
- Human in the loopActions with impact, such as sending an email, wait for approval. You decide per task what may run automatically.
- Audit trailEvery action by a user or agent is stored with a timestamp, who or which agent, and the source.
Audit trail
- 09:12 · Mail agent linked mail to file 2412source
- 09:13 · Quote agent drafted a confirmationdraft
- 09:20 · Lieven approved and sentwaiting
- 09:21 · Invoice agent prepared the invoicewaiting
GDPR, NIS2 and the AI Act: what it means for your project.
GDPR: a data processing agreement first
When we process personal data for you, we sign a data processing agreement first (Art. 28 GDPR). We apply purpose limitation and data minimisation: only the data that is needed, for a purpose set in advance.
AI Act: the risk depends on the use
Process automation such as linking emails or preparing quotes usually does not fall under high risk. AI in recruitment or credit scoring does; stricter rules apply there from December 2027. We assess this per project.
NIS2: your suppliers count too
If your company falls under NIS2, you also need to show the security of your supply chain. We give you the information on hosting, encryption, access management and our security tests.
What it learns stays yours.
Everything the system learns about your clients, prices and exceptions is company knowledge. It belongs to you, not to the model.
01
Who owns the data and what the system learns?
You do. Your data and every rule the system learned about your company are yours.
02
Can we read what the AI knows?
Yes. Rules and facts are in plain language. Your team can open, edit or delete them, and sees who approved each rule.
03
And if we stop working together?
You get a full export of your data and of everything the system learned.
Questions about security.
Storage does not: it lives in Google Cloud in Belgium. When an application uses a model from Anthropic, OpenAI or Google Gemini, that model only gets the context the task needs, and that processing can happen outside the EU. If that is not allowed, we choose an open source model.
No. Anthropic and OpenAI do not use data sent through their business API to train models, and neither does Google with data sent through Vertex AI. We do not use your data to train models for others either.
Models from Anthropic and OpenAI through their business API, Google Gemini through Vertex AI, and open source models where data may not leave your environment. We choose per application, based on quality, cost and where the data may go.
An email or document can contain hidden instructions that try to mislead an AI agent. That is why an agent can only do what its permissions allow, and actions with impact wait for a person's approval, unless you decide a task may run automatically.
Yes. Per source and per type of information we decide together what the AI may see. Some data never leaves your own systems.
Only the people working on your project, and only what they need to build and support it.
Yes. When we process personal data for you, we sign a data processing agreement before we start.
Curious what AI
could do for you?
Tell us what costs your team the most time. We show where AI and software make the biggest difference, and tell you honestly whether we can help.