Privacy Policy

Erfüllen provides a compliance workflow platform for AI governance, EU AI Act readiness, evidence tracking, document generation, MLOps monitoring, and related compliance operations. References to "Erfüllen", "we", "our", or "us" mean the provider of this platform.

We process account and workspace information, organization membership data, AI system metadata, risk classification inputs, evidence records, uploaded files, generated document drafts, audit logs, billing and plan information, integration settings, webhook events, and support/contact requests.

The Erfüllen Engine powers risk reasoning, compliance document drafting, and workflow assistance. Depending on configuration, the Erfüllen Engine may use Claude by Anthropic and Gemini by Google as underlying model providers. Information submitted for classification or document generation may be sent to these providers to produce AI-assisted output. These providers operate outside Erfüllen's primary EU vault when their features are used. Generated content is a draft and must be reviewed by your responsible human reviewer, legal team, DPO, or compliance officer before regulatory filing or external submission. See our Sub-processors Disclosure.

We use data to provide the service, authenticate users, enforce tenant access controls, classify AI systems, generate and manage compliance documentation, calculate compliance readiness, process evidence approvals, monitor MLOps events, send alerts, provide support, maintain security, and improve reliability.

If you connect MLflow, Weights & Biases, SageMaker, or another MLOps source, Erfüllen receives event payloads needed to identify model versions, stage or alias changes, metrics, and monitoring signals. We use this data to create monitoring events, trigger reassessment workflows, and help maintain compliance records.

Erfüllen's primary compliance data plane is hosted in the European Union (Frankfurt, eu-central-1). This includes workspace records, AI system metadata, evidence files, generated documents, audit logs, and private storage for compliance exports.

We share data with service providers only as needed to operate the platform. Primary EU vault processors include Supabase (database, authentication, storage), Vercel (application hosting), and Upstash (rate limiting). Additional processors — including AI model providers, email delivery, and billing — may process limited data outside the primary EU vault when their features are used. We do not sell customer data.

See the Sub-processors Disclosure and DPA & Processor Agreements pages for vendor details and GDPR Article 28 guidance.

Erfüllen is designed for tenant-separated access using organization-scoped authorization, audit logs, role checks, private storage with signed URLs, and server-side data access. Customers remain responsible for choosing appropriate user roles, reviewing generated content, and avoiding uploads of unnecessary sensitive data.

Read the Data Residency Overview for production verification details.

The following human-readable disclosure pages support this Privacy Policy:

We retain records for as long as needed to provide the service, satisfy audit and compliance needs, resolve disputes, enforce agreements, and meet legal obligations. You may request deletion or export subject to applicable contractual and legal limits.

You are responsible for the accuracy of AI system metadata, the legality of uploaded evidence, obtaining required consents, performing human review, and deciding whether generated documentation is suitable for a regulator, notified body, customer, or internal audit.

The decorative world map used in Erfüllen demo and product visuals is based on a World SVG map from Fla-shop.com, used under the Creative Commons Attribution 4.0 International license.

For privacy questions, contact us through the in-app Contact us form or email hallo@erfuellen.com.