Trust Center. Security, data protection and responsible AI.
How Solorai protects client data and uses AI responsibly: the controls we apply, how personal data is processed in the European Union, and how every AI system we deliver stays under human control.
Documents shared under NDA where required.
How does Solorai protect client data?
Client work runs inside your own Claude Enterprise organisation, with encryption in transit, least-privilege access and multi-factor sign-in. The website and email are hosted in the European Union, analytics run only with consent, and every client receives a data processing agreement.
Written and reviewed by Solorai
- controls in place
- 10/10
- hosting for website and email
- EU
- EU AI Act risk levels, checked for every system
- 4
Commitments
Which controls are in place?
Each commitment and its status.
| Area | Commitment | How | Status |
|---|---|---|---|
| Security | Encryption in transit | TLS on solorai.com and on every system we use for client work | In place |
| Security | Access control | Named accounts, multi-factor sign-in and least-privilege access | In place |
| Security | Client environments | Client work runs inside the client’s own Claude Enterprise organisation and systems | In place |
| Data protection | Data location | Website and email hosted in the European Union | In place |
| Data protection | Analytics | Only with consent; no analytics cookies without it | In place |
| Data protection | Retention | Enquiries kept for 24 months after the last contact | In place |
| Data protection | Rights requests | Answered within 30 days | In place |
| Responsible AI | Human control | Every AI agent in production runs with monitoring and a human in the loop | In place |
| Responsible AI | Risk classification | Every AI system we deliver is classified under the EU AI Act | In place |
| Responsible AI | AI literacy | Training included in every Claude Enterprise rollout | In place |
Data protection
How is personal data processed?
From the moment you write to us to the day your data is deleted.
- 01name@company.com
Collect
What you send us
The contact form and email. Analytics only with your consent.
- 02EUItaly
Store
European Union
Website and email hosted in the EU. Client data stays in your own systems.
- 03024 mo
Keep
24 months
Enquiries are kept for 24 months after our last contact, then deleted.
- 04Request answered
Your rights
Within 30 days
Access, correction, deletion, restriction, portability and objection.
ControllerSolorai, business@solorai.com
Responsible AI
How do we use AI responsibly?
Every system we deliver is classified against the four risk levels of the EU AI Act, then governed in four steps.
- 01
Inventory
A list of the AI systems your company uses or builds.
- 02
Risk classification
Each system classified under the EU AI Act, with the obligations that follow.
- 03
Internal policy
Clear rules on which tools, data and uses are allowed.
- 04
AI literacy
Training that supports the AI literacy of people who use AI, as Article 4 of the AI Act requires.
Documents
Which documents can we request?
For your procurement and security review. Shared on request, under NDA where required.
- DPAData processing agreementDPA for client engagements, with standard contractual clausesRequest
- ISPInformation security policyAccess, devices, encryption, incident responseRequest
- SPLSubprocessor listEvery provider that processes client or website personal dataRequest
- AIGAI use and governance policyHow we build, test and supervise AI systemsRequest
- IRPIncident response planRoles, timelines and notification for security incidentsRequest
5 documents, all at their current version.
FAQ
Trust, in short
Where is data stored?
Website and email data are hosted in the European Union. In client work, data stays in the client’s own Claude Enterprise organisation and systems, under the client’s policies.
Does solorai.com use analytics cookies?
Only if you allow them. Without your consent no analytics cookies are set, and you can change your choice at any time from Cookie settings.
Can we get a data processing agreement?
Yes. Every client engagement is covered by a data processing agreement with standard contractual clauses. Request it from business@solorai.com.
Who are your subprocessors?
The subprocessor list, with each provider, purpose and location, is available on request and shared under NDA where required. Website subprocessors are also named in our Privacy policy.
How do you keep AI agents under control?
Every agent we put into production runs with monitoring, logging and a human in the loop for the decisions that matter, and each AI system is classified under the EU AI Act.
How do I exercise my data protection rights?
Write to business@solorai.com to access, correct, delete, restrict or port your data, or to object to its processing. We reply within 30 days.
Related reading
- Service
AI governance framework and policy
Build an AI governance framework: AI policy, roles and accountability, risk management, approval workflows and monitoring of AI use across the company.
See the service - Glossary
What is sovereign AI
Sovereign AI explained: data residency, private and on-premise LLMs, and how companies keep control of AI models and data.
Read the definition - Service
EU AI Act compliance for companies
EU AI Act compliance for companies: AI system inventory, risk classification, obligations by role, AI literacy, documentation and governance.
See the service
Sources: Regulation (EU) 2024/1689, Regulation (EU) 2026/1744
Five documents for your security review. Shared on request.
DPA, security and AI governance policies, subprocessor list and incident response plan. Under NDA where required.