Hosted in Germany
Your content is stored on servers in Germany.
Security
Your data. Your control.
Chifty processes your company knowledge where you allow it, and shows only what the asking person is allowed to see. This page describes how that is technically implemented – with concrete evidence instead of seals.
Security at a glance
Emails not stored permanently
Mail content is fetched from your mailbox provider on demand, not stored with us.
No training on your data
Your content is not used to train AI models.
Permissions first
The AI only sees what the asking person is allowed to see.
Data handling & AI processing
Where your data lives, and how the AI handles it.
No persistent email content
We don't store email text in our database. Only metadata such as sender, subject fingerprint, and timestamps are stored – content is loaded from your mailbox provider on demand.
Hosted in Germany
Your content is stored on servers in Germany.
AI processing defaults to the EU
Our language models run on Google Cloud Vertex AI with the default region europe-west1 – exclusively European data centers there. Any other region is only used when a different model is explicitly selected – never through silent failover.
Zero data retention with our AI providers
With Google Cloud Vertex AI and OpenAI, we have contractually agreed that requests are not retained after processing.
No model training on your data
Your content is not used to train the AI models we use.
Knowledge base self-hosted
The searchable knowledge base – vector database, file storage, and document processing – runs on our own, self-operated systems rather than an external search or OCR service.
Permissions & access
The part we care about most.
Permissions first
Knowledge can be shared with the whole company, individual areas, roles, or specific people only. The AI respects every one of these approvals – in every search, answer, and draft. Sensitive areas such as HR, finance, or management stay protected when classified accordingly.
Checked at query time, not after
The permission filter is applied directly in the search, before a result exists – the AI itself cannot influence it. If the organization or role context is missing, the system returns nothing rather than too much.
Only authorized eyes read mail
Personal and shared mailboxes stay separate. You decide in the admin console who may read a mailbox, send from it, or manage it.
Drafts instead of auto-send
Chifty prepares reply drafts but never sends automatically. You review every draft and send it yourself, with sources visible.
Uploads with policy
You decide how new knowledge enters the shared base: open to everyone, admins only, or with an approval step. New versions can be reviewed before they take effect.
Central administration
Admins control connected sources, products, users, and access rights in one place.
Transparency
What you can see without having to ask.
Model choice visible per answer
In the chat, you can see for every answer which model was selected for it.
No trackers in the application
The Chifty application itself contains no third-party trackers or analytics software such as Google Analytics or the Facebook pixel. Our public website uses Google Analytics with cookie consent.
Encryption & operations
Encrypted in transit
The connection between your browser and Chifty is encrypted with TLS throughout.
Credentials encrypted at rest
Access credentials to your mailboxes are encrypted with AES-256-GCM before being written to the database.
Tenant isolation
Every request is scoped to the requesting organization – enforced centrally, not rebuilt separately in every area.
Rate limiting on public endpoints
Public forms, uploads, and the admin area are rate-limited to make automated abuse harder.
Checked before every change
Every code change runs through automated tests and checks before going live.
Compliance & data protection
Data processing agreement (DPA)
For business use, you receive a DPA under Art. 28 GDPR on request.
Concrete measures, not seals
Encryption, the permission model, and data processing agreements are the actual building blocks of our privacy approach – see the sections above.
Vetted sub-processors
Every provider we use is contractually bound to confidentiality. The full list is in the next section.
Sub-processors
These providers process data on our behalf. Chifty additionally accesses your existing Google or Microsoft mailbox with your permission; these remain your own contractual relationship, not our sub-processor.
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud (Vertex AI) | AI processing: language models for chat, summaries, and drafts | USA (processed in EU data centers, default region europe-west1) |
| OpenAI | AI processing (optional, model-dependent) | USA |
| Jina AI | Embedding and ranking of knowledge content | Germany |
| Speechmatics | Transcription of meeting recordings | United Kingdom |
| ElevenLabs | Voice input in chat (dictation) | USA |
| Stripe | Payment processing | USA / Ireland |
| IONOS SE | Hosting of this website | Germany |
| Google Ireland Limited | Audience measurement for this marketing website (Google Analytics) – only after your consent, not in the application | Ireland (transfer to the USA possible) |
Full details on the legal basis and technical/organizational measures per provider are part of our data processing agreement (DPA). We update this overview whenever it changes.
Deployment options
Chifty runs as SaaS today. For companies with their own infrastructure, we're preparing on-premise.
SaaS
StandardFully operated by us, ready to start immediately.
On-premise
On request · PilotSelf-hosted in your own infrastructure. Signed offline license with no license server or phone-home; your own AI models are possible. Currently a pilot project – get in touch.
Documents
Everything IT, legal, and privacy teams need to review Chifty.
Questions about security or your compliance process?
We answer IT and privacy questions directly, no queue.
Frequently asked security questions
How does Chifty encrypt my data?
The connection is encrypted with TLS throughout. Access credentials to your mailboxes are additionally encrypted with AES-256-GCM. We don't store email content at all – it's loaded from your mailbox provider on demand.
Is Chifty GDPR-compliant?
We implement concrete measures: a data processing agreement, encrypted credentials, a permission model the AI enforces, and vetted sub-processors. Details are in the sections above.
Where is Chifty hosted?
In Germany. AI processing defaults to EU data centers (region europe-west1).
Does Chifty train AI models on our data?
No. Your content is not used to train the AI models we use. We additionally have zero data retention agreements with our AI providers (Google Cloud Vertex AI, OpenAI).
What certifications does Chifty have?
Currently none – we're a young company without ISO or SOC 2 certification. We rely instead on verifiable technical measures, which this page describes in detail.
Can the AI access data a user isn't authorized to see?
No. The permission filter is applied inside the search itself on every request – the AI cannot bypass or influence it.
Who are your sub-processors?
The full list with purpose and location per provider is in the "Sub-processors" section above.
Does Chifty offer on-premise deployment?
Yes, currently as a pilot project for companies with their own infrastructure – with a signed offline license and no phone-home. Get in touch.
What happens to our data if we stop using Chifty?
Your access is deactivated. For deletion of your data, please contact us directly – we'll take care of it.