Enterprise data is stored in a multi-tenant architecture with strictly isolated logical database segments, preventing unauthorized access across customer environments. Sensitive AI workloads run solely on servers within the European Union, ensuring data sovereignty and regulatory compliance (e.g., GDPR). Optional LLM services outside the EU can only be activated on explicit customer request. Since the data centers hosting ai.go and its AI models are owned by a German company, the risk of data leakage is effectively eliminated.
ai.go’s highly available infrastructure leverages a geo-redundant network of certified data centers across multiple sites. These facilities comply with international standards and certifications, including ISO 9001, ISO 22301, ISO 27001, ISO 45001, PCI DSS, SOC 1/2 Type II, Cyber Essentials, HDS, and the EU Code of Conduct. Data retention periods and deletion intervals are configurable and restricted to Europe, fulfilling GDPR requirements for minimization, security, and storage limitation. A comprehensive operations dossier—including a transparency sheet and incident runbook—ensures accountability, monitoring, and rapid incident response. Customers can also export their data from ai.go at any time via an interface in a structured format.
To meet the requirements of the European AI Act, ai.go clearly labels AI-generated content (optionally with watermarking or machine-readable content credentials), blocks high-risk use cases (Annex III) via technical gating, and initiates tasks in an analysis-only mode by default. Additional safeguards—including a safelist for approved tools, role-based least-privilege access rights, rate limits, and moderation layers before outputs or tool calls—prevent misuse and meet the technical and organizational measures required under GDPR Article 32. Audit trails record prompts, parameters, and outputs, while admin switches and an emergency shut-off preserve human oversight.
