PrivaSearch
Book a demo

Hosted in the EU

Designed with EU hosting as the starting point.

PrivaSearch is designed with EU hosting, pseudonymisation and limited data transfer as the starting point. Processing and storage take place in data centres in the EU, and wherever possible we choose European providers. Which parties are involved in which link is set out in the overview of sub-processors; we record the hosting provider in the data processing agreement. PrivaSearch delivers this as a cloud service: we take care of hosting, updates and security, you don't have to install or manage anything.

Book a demo
  • Private S3-compatible storage in the EUOriginals are kept in a private bucket in a data centre in the EU, without public access. Each organisation has its own path prefix in it. Encryption of stored files is a property of the storage; a configuration check in the application checks the setting.
  • A separate database per organisationAn organisation's accounts, documents and activity log are in its own database, a separate database instance with its own address. The databases are accessed with the same database account; it isn't a separate server per client.
  • Detection happens within PrivaSearchThe model that finds personal data runs in our own environment in the EU, alongside the application. It reads the full document text for detection; no external AI provider is involved in this step.
  • European AI models, with one clear exceptionSemantic search only uses reviewed, pseudonymised text at a European AI provider, with a data processing agreement. Only a scan without a text layer goes as a file to that same provider to be read, and only if your organisation switches that on itself; after that the same pseudonymisation and review follow. If OCR is switched off, a scan is not read and not searchable.
  • One key per organisation for the pseudonym vaultEvery organisation has its own key, stored only in encrypted form; the key that unlocks it is held in a separate key service, not in the database: with only a copy of the database, the link between pseudonym and person stays closed.
Architecture
  • Application · EU data centre, own database and own address per organisation
  • Originals · private S3-compatible storage, EU region, own path per organisation
  • Detection · local language model (EU), no external AI call for detection
  • Pseudonym vault · key per organisation, only through the app
  • Embeddings · European AI provider, only reviewed, pseudonymised text
  • OCR of scans · European AI provider, only files without a text layer and only if your organisation switches it on
  • SharePoint · read-only connection, live permission check per user
  • AI assistants · through MCP with OAuth at your own address, never access to files

To be fair

What falls outside PrivaSearch.

  • You choose the AI assistant yourselfChatGPT and Claude come from American providers, Mistral Vibe from France. What PrivaSearch returns to the assistant becomes part of the conversation and so ends up with that provider, with pseudonyms instead of names.
  • SharePoint stays with MicrosoftIf you connect your SharePoint, the originals stay in SharePoint with Microsoft. PrivaSearch only reads them.
Where are my originals?

An uploaded document is kept in private storage in a data centre in the EU, with its own path per organisation. A document from SharePoint stays in SharePoint; PrivaSearch only reads it.

Does anything go to an American provider?

Only if you connect an American AI assistant. It receives the passages PrivaSearch returns, with pseudonyms instead of names. Detection, storage and the pseudonym vault run in the EU.

Who has access to the pseudonym vault?

Only the application, with a key per organisation that isn't in the database. Revealing a single pseudonym is only possible in the PrivaSearch web environment, by a project member with write access, and every reveal is logged. In PrivaSearch, every project member can open the original of a document; that is logged too.

Is the hosting provider fixed?

We record the hosting provider in the data processing agreement; which parties are involved in which link is set out in the overview of sub-processors.

What that means

One question fewer in every tender and every audit.

Where the processing takes place and which party is involved is on paper: in the overview of sub-processors, in the data processing agreement and in the register entry and the DPIA that your environment generates itself. See the paperwork.

Updated on

See in twenty minutes what happens to your documents.

We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.

Book a demo →