Security & Compliance

Overview

Parnidia builds AI agents that talk to your customers, so protecting their data is part of the product, not an add-on. This page is a general overview of how we handle data and the controls we apply. For a specific service, the terms of your signed contract and Data Processing Agreement (DPA) apply.

Every client signs a Data Processing Agreement (DPA) with us. Its key commitments:

• EU data centres: our databases are hosted in the EU.
• No training on your data: we don't use your conversations, call recordings or transcripts to train AI models.
• Breach notice: we notify you of a personal data breach without undue delay and, where your DPA sets this term, no later than 24 hours after becoming aware of it.
• Return or deletion: when the contract ends, we return or delete your data at your choice within 30 days, unless the law requires us to keep it longer.

Compliance

• GDPR: we act as your data processor under a signed DPA based on GDPR Article 28. You remain the controller: you decide how your customers' data is used, and you are responsible for having a lawful basis for the processing and for informing your customers and employees about it.
• EU AI Act: how a system is classified under the Act depends on its purpose and how it is used. For our customer service agents, the key obligation is transparency: people are told they are talking to AI. AI Call Analytics used to evaluate employees' work can fall into a stricter category, so its classification depends on how the client uses it.
• Audits: the DPA gives you the right to audit how we process your data, with the notice period set in your DPA. Audits usually start with a remote review of documents and processes. Further checks, including on-site inspections, follow your DPA and applicable law.

Data hosting and residency

Where data is stored and processed depends on the product and the provider. Parnidia's databases are hosted in EU data centres. AI Voice Agent and AI Call Analytics data is hosted in the EU. For the AI Chat Agent, replies are generated with OpenAI and Anthropic models, so conversation data reaches the US. Where AI requests are processed, and where backups and technical logs are kept, depends on the provider used for each product; your DPA lists the sub-processors for your service and where they process data. Our team works remotely, under the access controls described below. Any transfer outside the EEA follows GDPR Chapter V and your DPA.

Encryption

• In transit: all connections to our systems use TLS encryption.
• At rest: stored files and records are encrypted.
• Transfers: personal data sent by email or on physical media is encrypted and password-protected, with the password shared through a separate channel.

Access control

• Access follows least privilege: team members only see the data they need for their role.
• Administrators sign in with multi-factor authentication, plus VPN or IP restrictions when working remotely.
• Passwords follow complexity rules, are stored hashed, and accounts lock after repeated failed attempts.
• Shared accounts are avoided, and every access grant, change and removal is recorded.
• Access rights, especially privileged ones, are reviewed at least once a year.

People security

• Every team member signs confidentiality and non-disclosure commitments before getting access to personal data.
• Security duties are written into employment contracts, including obligations after employment ends.
• The team receives regular security and data protection briefings.
• Access is removed no later than a person's last working day.
• Remote work follows a documented policy: approved devices, VPN and no public networks for sensitive work.

Infrastructure and network

• Firewalls with intrusion detection and prevention monitor traffic in and out of our systems.
• Production networks are separated from other networks, and admin access only comes from approved devices.
• Servers and databases run with least-privilege service accounts and hold only the data needed for the service.
• Pseudonymisation is applied where data is used for more than one purpose.

Device security

• Work computers use full-disk encryption and antivirus updated daily.
• Critical security patches are installed promptly.
• Screens lock automatically after inactivity, and lost devices can be wiped remotely.
• Copying personal data to USB sticks or external drives is blocked.

Logging and monitoring

• Every access to personal data is logged with date, time and action, and logs are kept for 6 months.
• Logs are tamper-protected and use synchronised timestamps.
• All administrator actions are recorded.
• Monitoring raises alerts on unusual activity, load or performance.

Application security

• We follow secure development practices, including OWASP guidelines.
• Security requirements are defined at the start of every project.
• Software and infrastructure are tested for vulnerabilities before release and on a regular schedule.
• Updates are tested before they reach production, and development uses a separate environment with test data.
• All significant system changes are tracked under a documented change management policy.

AI safeguards

• Clear AI disclosure: people always know they are talking to an AI agent, in chat and on the phone.
• No training on your data: we don't use your conversations, call recordings or transcripts to train AI models. For the AI Chat Agent, we use OpenAI and Anthropic through their business APIs; under their commercial terms, data sent through these APIs is not used to train their models by default.
• Provider certifications: OpenAI and Anthropic hold SOC 2 and ISO/IEC 27001 certifications for their business services. These are the providers' certifications, not Parnidia's.
• No biometric data: we don't create voiceprints or other biometric identifiers from calls.
• Improving your agent is not model training: we review conversations only to improve your own agent's instructions, settings and knowledge base, never to benefit other clients.

Incident response

• We have an incident response plan with defined roles and a single point of contact.
• Every security incident is logged and reviewed, and the lessons are used to strengthen our controls. Incidents that involve personal data are handled as personal data breaches.
• We notify you of a personal data breach without undue delay and, where your DPA sets this term, no later than 24 hours after becoming aware of it.
• We give you the information you need to report a breach to the supervisory authority within 72 hours. We also help you respond to data subject requests and, on request, carry out a data protection impact assessment.

Business continuity and backups

• Incremental backups run daily and full backups weekly.
• Backups are monitored for completeness and tested regularly.
• Backup copies are stored in geographically separate locations.
• Named team members own continuity if an incident affects our systems.

Data retention and deletion

We keep your data only while we provide the service. Before the contract ends, you can ask us to return your data. At your choice, we return or delete it within 30 days after the contract ends, unless the law requires us to keep it longer, and confirm the deletion as set out in your DPA. Access logs and backups have their own retention periods: access logs are kept for 6 months, and we can tell you the backup retention period for your service on request. Storage media are securely wiped or destroyed before disposal.

Sub-processors

These third parties process customer data on our behalf. Not every provider is used for every product: the list shows which product each one supports, and the binding list for your service is in your DPA. Each provider is bound by data protection obligations at least as strict as our DPA. We notify you in advance before adding or replacing a sub-processor, and you can object as set out in your DPA.

Frequently asked questions

Contact

Questions about security, or found a vulnerability? Email our CTO at alex@parnidia.com. We respond to security reports as a priority.