Security

1. Where data is located

• Database and files: EU (Ireland).
• Microsoft 365 connector: Microsoft Azure, Poland Central.
• EU AI models: Microsoft Azure, Data Zone EU (data stored in Sweden Central); USA / global AI models: Lovable AI Gateway, OpenRouter (SCC / EU–US Data Privacy Framework).
• E-mail delivery: Slovakia.
• Website delivery: global content delivery network (Cloudflare).

Indexing and search in uploaded sources currently use OpenAI embeddings through the Lovable AI Gateway outside the EU (see Sub-processors).

2. Encryption

All connections to Baaito are encrypted in transit with TLS. Secrets such as connector credentials and API keys are stored encrypted on the server.

3. Organisation separation and role-based access

The data of each organisation is kept separate from other organisations. Within an organisation, roles decide who can access what, and these permissions are enforced on the server and in the database, not only in the user interface.

4. Audit log

Security-relevant and administrative actions are recorded in an audit log that organisation administrators can review.

5. Backups

Backups are kept for 35 days.

6. AI providers and training

Each organisation’s administrator controls which AI models and providers are enabled for the organisation. Customer content is not used to train AI models, and we require our AI providers not to train on it. More in How Baaito uses AI.

7. Incident notification

We notify the customer organisation of a personal data breach without undue delay and at the latest within 48 hours after becoming aware of it, as set out in the Data Processing Agreement.

8. Sub-processors

All sub-processors, their purpose and data location are listed on the Sub-processors page.

9. Contact

Security questions and reports of vulnerabilities: info@baaito.app.