Where your data is stored, and GDPR

Where it is stored

Veillo's server functions are configured for Vercel's Frankfurt region. The production database should use an EU region, but that setting must be checked in the provider account. Content delivery, support, security, billing, email, and optional analytics or AI providers can have wider processing boundaries. The current picture is on the security page and subprocessor register.

GDPR and the DPA

Veillo is built EU-first, and we offer a Data Processing Agreement. If your organisation needs a signed DPA in place, you can review and request ours from the DPA page. It sets out how we process data on your behalf, where it is hosted, and who our sub-processors are.

Who can see your data

Your workspace is yours. We keep it that way in three concrete ways.

• Access is role-based. Inside your organisation, who can see and change what is set by roles. You can give an external auditor a read-only view without exposing billing or letting them change anything.
• We do not sell data. Your compliance records are not a product.
• We do not train models on your records. The AI-assisted suggestions use models, but your register and documents are not training data.

Sub-processors and deletion

Our current sub-processors are listed in the DPA, and how we handle personal data is set out in the privacy policy. You can export your data at any time and ask us to delete it. See export everything and leave.