Where your data is stored and processed

Quorum Technologies GmbH is a Swiss company. Swiss data protection law, the FADP, governs our processing.

Europe

| What | Where | |---|---| | Our own services | Amsterdam, Netherlands | | Database (MongoDB Atlas) | Netherlands, on Microsoft Azure West Europe | | File storage (Cloudflare R2) | European Union | | Application hosting (Vercel) | European Union for compute | | Transactional email (Resend) | European Union |

Files are held in a bucket created under Cloudflare's EU jurisdiction, which means the objects themselves stay in the European Union rather than being placed wherever is nearest. That is a stronger guarantee than a region setting.

The United States

Three providers process data in the United States, and they are the ones that receive text:

• OpenAI turns document extracts into embeddings so that search works.
• Groq generates the briefing text.
• ElevenLabs turns the finished script into speech.

We say so plainly rather than describing this as global processing. Each transfer has a safeguard behind it: ElevenLabs is certified under the EU–US, Swiss–US and UK–US Data Privacy Framework, and OpenAI and Groq are covered by Standard Contractual Clauses under our data processing agreements with them.

None of the three may train on the data we send.

Two companies that are not our subprocessors

• Microsoft. Calendar and document access runs against your own Microsoft tenancy, under the agreement your organisation already has with Microsoft. We read from a system you control, with permission you grant and can withdraw.
• Stripe. Stripe decides for itself how it handles card data in order to meet its own regulatory and anti-fraud obligations, which makes it a controller in its own right rather than our processor.

The full list, with what each provider does, is Annex III of our Data Processing Addendum at quorumtech.ch/legal/dpa.