Everything procurement teams, IT leaders and data protection officers need to know about hegyon.ai, Swiss hosting, sub-processors, encryption, FADP and EU AI Act conformity, DPA on request. One page, no detours.
hegyon.ai is not "also secure". Security, data residency and auditability are the preconditions on which the product stands, not an add-on reserved for large enterprises.
Application data, backups and logs sit at Hostpoint in Zurich. No extraterritorial cloud dependency through the back door.
Network isolation, firewalls, hardened hosts, regular penetration tests and vulnerability scans across multiple layers.
Content from hegyon.ai is never used to train third-party models. LLM providers are engaged under no-training terms.
Every interaction, prompt, routing decision, provider response, guard intervention, is recorded in a tamper-resistant chain.
Processing under the revised Swiss Federal Act on Data Protection. Data classification, processor relationships, data subject rights, breach notification.
Guardrails, AI literacy training, risk classification and audit trail, aligned with the EU Artificial Intelligence Act.
Go to EU AI Act page →Processing of personal data for customers with EU exposure under Art. 28 GDPR. Standard Contractual Clauses, EU-US Data Privacy Framework.
Hostpoint operates ISO/IEC 27001-certified Swiss data centres. Internal security processes are aligned with the standard.
Complete public list of the providers that process data on behalf of hegyon.ai. Each entry with location, purpose, data category and transfer mechanism.
| Provider | Location | Purpose | Data categories | Transfer mechanism |
|---|---|---|---|---|
| Hostpoint AG | Switzerland (Zurich) | Hosting · backups · mail relay | All application data | Processed in Switzerland · no third-country transfer |
| OpenAI, L.L.C. | USA | LLM inference (GPT models) | Prompts and documents after Sensitive Data Guard filter | EU-US Data Privacy Framework · Standard Contractual Clauses · no-training agreement |
| Anthropic PBC | USA | LLM inference (Claude models) | Prompts and documents after Sensitive Data Guard filter | EU-US Data Privacy Framework · Standard Contractual Clauses · no-training agreement |
| Google LLC | USA / EU | LLM inference (Gemini models) | Prompts and documents after Sensitive Data Guard filter | EU-US Data Privacy Framework · Standard Contractual Clauses · no-training agreement |
| Mistral AI | France (EU) | LLM inference (Mistral models) | Prompts and documents after Sensitive Data Guard filter | Within EU/EEA · GDPR-compliant · no-training agreement |
| Microsoft Corporation* | EU / USA | Microsoft 365 integration (Email, Teams, SharePoint, Planner), optional | Only when activated · selective content per enabled feature | EU-US Data Privacy Framework · Standard Contractual Clauses |
* Microsoft is activated exclusively when the customer enables the Microsoft 365 integration in the platform settings. By default the integration is disabled.
Changes to this list are communicated at least 30 days in advance via the Trust Center and, on request, by email.
Four stations, four protection layers, before a prompt ever leaves the company.
Employees interact with the copilot through a Swiss application layer. Up to this point, the data does not leave Switzerland.
Before any forwarding to an LLM, the guard classifies content: personal data, contract data, financial figures are masked or blocked.
Depending on the class, the prompt is routed to an approved provider, EU providers first, US providers only for non-sensitive content.
The response is checked against permissions (e.g. signature limits). Every action is recorded in the tamper-resistant audit chain.
Do you need a Data Processing Agreement (DPA) for your internal data protection documentation? We send our current template within one business day.
All application data, backups and logs are physically located in Switzerland (Hostpoint Zurich, ISO 27001-certified data centre). Only those parts of a prompt that remain after the Guard filter and are actually forwarded to an external LLM provider leave Switzerland, under documented transfer mechanisms.
No. hegyon.ai engages LLM providers exclusively under no-training agreements. Content you enter is not used to improve third-party models.
Access rights are controlled via roles (RBAC) and data classification. Site management sees different content than accounting; the external trustee only sees what has been released. Multi-factor authentication is standard.
Incidents are handled in accordance with revFADP and GDPR: you are informed within 72 hours, the audit chain enables fast reconstruction of the incident, and where required notification to the FDPIC is filed.
Application data, backups and logs are entirely in Switzerland under Swiss law. US providers are engaged only for LLM inference and only for content released by the Guard filter, under documented transfer mechanisms.
Via the "Request DPA" button at the top of this page, or by email to legal@hegyon.ai. We send the current template within one business day.
Book a 30-minute security review. We walk through your requirements point by point, FADP, EU AI Act, sub-processors, DPA, technical security.