Compliance,all inone place.
Data protection, data processing, security and your rights. Instead of new legal texts, the four documents that are already binding.
In short: Data in the EU, a personal data check in the chat, an activity log and a deletion policy: what XOS delivers for the GDPR and the EU AI Act today, and what it does not yet.
As of November 12, 2026 · ProzessXFour documents that are binding.
Data protection
Controller, processors, retention periods and deletion policy, complete and kept up to date. A new recipient is a formal change, not a silent edit. xos.prozessx.com/datenschutz
Your rights (GDPR)
Access, rectification, erasure, data portability and objection, and how to exercise them (section 11 of the privacy policy). xos.prozessx.com/datenschutz
Data processing (DPA)
The data processing agreement under Art. 28 GDPR: subprocessors listed, obligations, reporting channels for incidents. xos.prozessx.com/avv
Security and EU processing
A dedicated database per customer, a personal data check before every AI call, EU processing as a switch per company.
Three things are switched on by default.
What XOS actually delivers.
The activity log shows every AI call: time, the person who triggered it, tool, risk rating and result.
Data protection tools
Record of processing activities, deletion policy and the ability to answer access requests are part of the system, not a folder next to it.
Traceability of AI use
Every AI operation is logged: what was done, who requested it, with which model and with what result. This supports the transparency obligation.
ISO 27001
Not certified yet. Preparation is underway. If a certificate is a requirement for you, we'll sort that out before the project starts instead of in the middle of it.
Frequently asked questions.
Where is our data stored?
Your company data is stored in the EU, in a dedicated database per customer instead of shared tables. This applies to the knowledge base, chat histories, attachments and the organization knowledge.
And the AI models, do they run in the EU too?
Not all of them, and we say so openly. What matters is the check beforehand: before every call, XOS checks whether personal data is included, attachments too. Administrators can switch this check off. It is pattern-based and does not catch every detail. In addition, non-European models can be blocked company-wide.
Is our data used for training?
No. There is a data processing agreement, a record of processing activities and a deletion policy. The subprocessors are named in them.
Is XOS ISO 27001 certified?
No, not yet. Preparation is underway. If a certificate is a requirement for you, for example due to group policy or audit obligations, we'll sort that out before the project starts instead of in the middle of it.
More background: The EU AI Act for mid-sized companies, AI and the works council and our approach to Responsible AI, all on prozessx.com (in German).
Questions about data protection? We clarify data processing, the deletion policy and model choice before the project, not in the middle of it.
Book a consultation.
Together we look at your processes and show you what XOS can take over. 60 minutes, free and without obligation.
- Choose a timeOpen slots in the calendar, by video call or phone.
- Prefer to talk now?+49 7452 6051953Give us a call, we also answer questions without an appointment.