---
title: "Data and security"
url: https://aiactaudit.ai/data-security
published: 2026-10-29T17:44:35.151Z
updated: 2026-10-29T17:44:35.151Z
summary: "What a DPO asks before trusting a tool: where the data lives, who can read it, how to take it out."
---

# Data and security

> What a DPO asks before trusting a tool: where the data lives, who can read it, how to take it out.

## Data and security

What you would ask before you trust a tool.

## No client data to an AI supplier

The AI system used by the law watch reads public official texts only. No client data is sent to any AI supplier.

## One tenant key on every row

Each client workspace is separated by a tenant key on every record. Nothing mixes across clients.

## Export and deletion

You can export your registers and delete your data at any time.

## Hosting

The service runs on Cloudflare (D1 and R2). Data location and processor terms are read before launch: [TBD until read].

## Retention

Retention per data class: [TBD: ask user].

## Operator sign-in

The operator's sign-in uses a second factor.

## Open points

The service privacy notice and the data processing terms for experts come before the paid launch.

## Questions about data?

Write to contact@aiactaudit.ai.