Security
EU-hosted: the app runs on Vercel in Frankfurt, the database is Neon on AWS in Frankfurt, and answers are drafted by Mistral AI, a French company processing in the EU. Questionnaire and knowledge-base content is stored and processed in EU regions.
Vercel, Neon, and Stripe are US-headquartered or US-linked groups. Their data processing agreements cover any access from outside the EU with Standard Contractual Clauses or the EU-US Data Privacy Framework. Stripe processes billing and identity data, never questionnaire content.
Our hosting, database, and AI providers publish SOC 2 Type II and ISO 27001 reports for their own services. Traffic uses TLS 1.2 or higher, and the providers encrypt data at rest (AES-256 per their documentation).
Short answers for vendor reviews. Full legal detail is in the DPA and the Privacy Policy.
| Question | Answer |
|---|---|
| Where is my data hosted? | In the EU: storage in Frankfurt (Vercel, Neon on AWS), AI drafting by Mistral AI in the EU. Vercel and Neon are US companies; see the sub-processor list. |
| Is AI trained on our data? | Qlara does not train models on your data. The data processing agreement is published at /dpa. |
| Are our source files stored permanently? | No. Policy documents are kept only as extracted text, and buyer Excel files are kept so answers can be written back. You can delete them at any time, and all workspace content is deleted 30 days after the account closes. |
| Do we get our original Excel back? | Yes. XLSX export into the original file is included in both plans. |
Application compute runs on Vercel in Frankfurt. The database is Neon on AWS in Frankfurt. Embeddings and answer drafts are generated by Mistral AI in the EU. Knowledge-base text and buyer spreadsheets are not sent to US model APIs.
Our hosting, database, and AI providers publish SOC 2 Type II and ISO 27001 reports for their own services. Traffic uses TLS 1.2 or higher, and the providers encrypt data at rest (AES-256 per their documentation). Qlara itself holds no SOC 2 report or ISO 27001 certificate. Answers that claim a certification your sources do not support are flagged for review.
Traffic to the service uses HTTPS with TLS 1.2 or higher. The database and hosting providers encrypt data at rest (AES-256 according to their documentation). Passwords are stored as salted scrypt hashes, never in plaintext.
For personal data you load into the knowledge base and questionnaires, you are typically the controller and Qlara is the processor under GDPR Article 28. The data processing agreement is published at /dpa. The Swedish text is binding. Account and billing processing is described in the Privacy Policy.
These providers process data only to deliver the service. Questionnaire content is not sent to US model APIs. Stripe handles billing identity, not knowledge-base or Excel files.
| Provider | Purpose | Region |
|---|---|---|
| Vercel Inc. | Application hosting, network delivery, and operational logs | Frankfurt (fra1). US company; SCCs/DPF |
| Neon Inc. (on AWS) | PostgreSQL storage for accounts, knowledge bases, and questionnaires | Frankfurt (aws-eu-central-1). US company; SCCs/DPF |
| Mistral AI SAS | Embeddings and cited answer drafting. | EU (France) |
| Stripe Payments Europe Ltd | Payments, Checkout, Customer Portal, and invoices. Never questionnaire content. | Ireland, with Stripe group transfers under SCCs/DPF |