Trust
Where HaloGuard EU runs, what we keep, and who helps us run it. This describes today's setup.
Where it runs
The HaloGuard EU API and console run on Google Cloud in the Netherlands and Belgium. This is today's setup, not a promise to keep that region.
Test-run scoring, and some checks of API traffic, also happen in the EU, at an AI service provider.
The Astroware EU AI Act Risk Screening tool sends the website text it reads, or the sentence you type, to an AI service provider that may process it outside the EU.
Our team runs it remotely from the United Arab Emirates and India. The data stays on the machines in the EU.
What we keep
The text you send to the API is held in memory to answer it. The model server may keep a processed form of it in memory until the server restarts. We never save it in a log, a file or a database.
Usage records are kept for 90 days. Security and account-action records are kept for 24 months. Backups hold data for up to 7 more days.
We store your API keys only as a one-way hash and a short display of their first three and last four characters.
We do not use Customer Data to train or improve HaloGuard EU or any other model.
Encryption
Connections to our website, console and API are encrypted (HTTPS).
Service providers
For the HaloGuard EU API and test runs: Google Cloud (hosting; Netherlands and Belgium) and Decision Models (scoring; EU). The services that run our website and console accounts are listed in our privacy notice.
Google Cloud's certification
Our API runs on Google Cloud, which is certified to ISO/IEC 27001.
Data processing agreement
Our data processing agreement is ready to sign: write to core@astroware.ai. Until it is signed with your company, send no personal data to the API (Terms, section 10.3).
Limits
HaloGuard EU is a technical control, not legal advice or a compliance guarantee.