Trust, privacy, and data processing

In the European Union, on AWS in Frankfurt.

Every member has one of four roles: Owner, Admin, Manager or Operator, each tied to a region, location or segment. Office staff can sign in with your company login through single sign-on, and your directory can create and disable accounts over SCIM. Staff without a company address sign in with an email code.

Annex 2 of our data processing agreement lists them. Among others: least privilege and role-based access, strong authentication for administrators where possible, logging and monitoring, encryption of data in transit, periodic backups with recovery tests where appropriate, incident procedures, patching and vulnerability management, and confidentiality obligations for everyone with access.

We inform you without undue delay, with the information you need for your own GDPR notification. On request, we share what shows we comply, such as policy documents and summaries of our security measures.

Yes, such as hosting and infrastructure, each under a written agreement with at least the same data protection obligations as our DPA. We tell you before we add or replace one, and you can object within 30 days. Ask us for the current list.

Only what that member can already see in Aristotl, in one organization. Admins can turn the Claude and ChatGPT connector off for the whole organization, and Aristotl does not store the conversation.

Our data processing agreement and privacy policy are published on this site. Anything specific to your legal or security review is best raised before a pilot.

You can export your content and have your data deleted. Your source documents stay yours throughout.

Email support@aristotl.com. The same contact is listed in our security.txt.