--- title: Trust Center: data protection, EU hosting, security | XOS description: Proof in one place: EU hosting, a dedicated database per customer, personal data check, activity log. What's in place and what isn't yet, named honestly. url: https://xos.prozessx.com/en/trust/ --- # Proof, not promises. What XOS delivers today, what it doesn't yet, and where the binding texts are. No seals that don't exist. [Book a demo →](https://xos.prozessx.com/en/book-a-demo/)[Sign up](https://xos.prozessx.com/signup) In short: Proof in one place: EU hosting, a dedicated database per customer, personal data check, activity log. What's in place and what isn't yet, named honestly. As of November 12, 2026 · ProzessX Proof instead of claims. We state exactly what's in place, and what isn't yet. ## Three statuses, named honestly. No logo without a basis. The status shown is the one that applies today. Available ### GDPR Data processing agreement under Art. 28, record of processing activities, deletion policy and the ability to answer access requests. Your data subject rights are set out in the privacy policy. Supported ### EU AI Act Every AI operation is logged: time, the person who triggered it, tool, model, risk rating and result. This supports the transparency obligations for AI use. In preparation ### ISO 27001 Not certified yet. Preparation is underway. If a certificate is a requirement for you, we'll sort that out before the project starts. How a message is routed ### Every AI call is checked first. If a message contains personal data, attachments included, it is automatically sent by default to a model that processes data in the EU, even if a different one is selected. Administrators can switch this check off. It is pattern-based and does not catch every detail. - Check: before every AI call. Rerouting to an EU model applies in the chat, and is in development for workflows. The personal data check is on by default. Administrators can deliberately switch it off. This is logged and shown to all users in the chat. - EU processing: one switch per company. - Block models: non-European models can be excluded company-wide. - Log: every call is recorded. [More under Compliance →](https://xos.prozessx.com/en/platform/compliance/) Message Personal data check EU model or your chosen model Log entry ## Five principles built into the system. 01 ### A dedicated database per customer 1-to-1 separation instead of shared tables. Your company data is stored in the EU. 02 ### Permissions and roles Per area and module, down to individual operations. An agent sees nothing the person who triggered it isn't allowed to see. 03 ### Block models Non-European models can be blocked company-wide, without anyone having to deselect them one by one. 04 ### Log The activity log shows every AI call with time, the person who triggered it, tool, risk rating and result. 05 ### Deletion policy A deletion policy is in place, as is the record of processing activities. 06 ### Built in-house Architecture and code are entirely in the hands of our team, no licensed software at the core. What the documents say is what applies. A new data recipient is a formal change, not a silent edit. [Privacy policy](https://xos.prozessx.com/datenschutz/) [Data processing (DPA)](https://xos.prozessx.com/avv/) [Terms and conditions](https://xos.prozessx.com/agb/) [Legal notice](https://xos.prozessx.com/impressum/) ## What you won't find here. 01 ### ISO 27001 Not certified yet. Preparation is underway. We tell you before the project, not in the middle of it. 02 ### Accessibility of your website That belongs in consulting, not in the product. We tell you which is which. 03 ### Legal assessment of individual cases XOS provides tools and proof, not a legal assessment of your case. ## Frequently asked questions. Is XOS ISO 27001 certified? No, not yet. Preparation is underway. If a certificate is a requirement for you, for example due to group policy or audit obligations, we'll sort that out before the project starts. Do all AI models run in the EU? Not all of them, and we say so openly. What matters is the check beforehand: if personal data is involved, the message is automatically sent to a model processing in the EU by default. In addition, non-European models can be blocked company-wide. How do I prove how AI is used? Through the activity log with timestamp, person who triggered it, tool, risk rating and result. This supports the transparency obligation of the EU AI Act. Where can I see the subprocessors? In the data processing agreement (DPA), which you can view at /avv/. ★★★★★ “Top partner, always quick, uncomplicated and efficient solutions.” Koch Lichteffekte Google review ★★★★★ "Anyone who wants to shape the future rather than just manage it is in exactly the right place with Prozess X. The collaboration was professional, practical and inspiring." Bässler GmbH Google review ★★★★★ “I've known the team for quite a while and value their reliability. When ProzessX says they'll take care of it, it actually happens. Hats off!” Ahmet Güzelhan Google review ## Questions about our evidence? We clarify them before the project. [Talk to sales →](https://xos.prozessx.com/en/contact/)[Sign up](https://xos.prozessx.com/signup)