GDPR

The General Data Protection Regulation, (EU) 2016/679, is the European Union's data protection law. It is not a certificate: it applies directly to every company that processes personal data in the EU, and in Romania it is enforced by the national supervisory authority, ANSPDCP.

How we work

For the data in your ERP, CRM, accounting, files and mail, Vaulty acts as your processor. We process it only on your documented instructions, and we do not use it to train AI models. The AI model runs in Microsoft Azure's EU data zone, on your own Azure, or on your own hardware. Connections to your systems are read-only, access follows the roles and departments you set, credentials are encrypted for each company, and an audit log records who asked what and which query ran.

What we are completing

The data processing agreement required by Article 28, signed with every client; our record of the processing we carry out; a public list of subprocessors, with notice before we add a new one; a breach notification procedure, so that if we become aware of a personal data breach affecting your data we notify you without undue delay and you can meet your own 72-hour obligation; help with access and deletion requests; and deletion or return of your data when the contract ends. This card will say "Compliant" only when all of these are in place.

Your own users and visitors

For data about the people who use Vaulty in your company and about visitors to this website, we are the controller. Our Privacy Policy explains how we handle it.