Data protection

OurAI is a Danish company, and the platform is hosted in Hetzner's datacenter in Helsinki, Finland. Every database runs there, including those holding your conversations, files, audit log and account records. Outside the platform, the sub-processors listed below hold only the data their service requires, such as billing details at Stripe and error reports at Sentry.

Your conversations and files leave the platform only when they are sent to an AI model for processing. The model catalogue states the jurisdiction of each provider, and your administrators can restrict which models your organisation may use. If a model becomes unavailable, the platform automatically routes the request to another model, and never to one in a less strict jurisdiction than the model selected.

Each request to an AI provider contains the conversation, the text extracted from your attached documents, any images you attach and the system instructions we add. Images are sent as they are, without the metadata the file carries, such as where and when a photo was taken, because a picture cannot be checked for personal data the way text can. Your administrators decide whether images may be attached at all. The request contains no identifying metadata: No name, email address, account or organisation identifier, or IP address. Requests are made under OurAI's own account with each provider, so they are attributed to OurAI, not to you or your organisation. Every provider whose models are available on the platform is bound by terms that exclude training on data sent through its API, and OurAI does not train AI models.

When your organisation enables redaction, personal and confidential data is replaced with placeholders before the request leaves the platform. The original values are restored on our side when the answer returns, so the provider only ever processes the placeholders. Redaction reads text, so it does not change an attached image.

Every message and every answer is checked against our acceptable-use policy by a classification model we run on our own GPU server in Helsinki, so this check never sends your content outside our infrastructure. The classifier reads text, so an attached image is not part of what it judges. Your organisation cannot disable it. If the classifier is unreachable, times out or returns an invalid result, the request is blocked rather than forwarded unchecked.