Processing in the EU
Your documents are processed in the EU. Retention and deletion are fixed bindingly before the pilot.
Home › Security
The name is the programme: every assessment with a traceable source.
Anyone letting a machine take part in decisions about providers needs more than a promise. This page lays out how Leapfacto handles your data, what the system does not do and which evidence is still missing.
Evidence
Evidence, not assertion
Three commitments that hold even when they are inconvenient.
Sources
Every finding with a source
For every assessment, Leapfacto shows the passage in the document that supports it.
Human in the loop
People decide
No automatic verdict about your vendor. Assessments are submitted for approval.
Data
Data residency and data processing
Processing in the EU. We settle the data processing agreement before a pilot starts, and your content is not used to train models.
Data
What we work with and what we do not
No model training on your content
Your documents are not used to train models. They do not improve anyone else's models.
Access only to what you upload
Leapfacto reads the documents you upload. There is no write access and no connection to your systems.
Contract
Data processing and deletion
- We settle the data processing agreement bindingly before the first upload happens.
- Retention and deletion are fixed before the pilot instead of negotiated after it.
- Deletion follows your instruction; the periods sit in the contract, not in a footnote.
- Privacy and DPA requests go to info@leaplytics.de and are answered before the project starts.
Limits
What we do not claim
- There is no SOC2 certification. It is the goal, and no date is set yet.
- There is no ISO 27001 certification.
- There is no running inside your own infrastructure.
- There is no connection to your systems: no write access, no agent.
- What holds today is the contract: processing in the EU, a data processing agreement before the pilot, no training on your content.
FAQ
Common questions
Are you SOC2 certified?
No. We do not claim a certification we do not hold. SOC2 is the goal; we will name a date once it is reliable.
Is a model trained on our data?
No. Your content is not used for training, neither for our models nor anyone else's.
Where is the data processed?
In the EU. Retention and deletion are fixed bindingly before the pilot.
Do we get a data processing agreement?
Yes. It is in place before any documents are uploaded. Requests go to info@leaplytics.de.
Contact
Check our commitments against your requirements.
If your IT or privacy function has questions about the data path, we answer them in writing and preferably before the first upload.
Book a demo →Or email us: info@leaplytics.de
Requests about DPA and privacy: info@leaplytics.de.