Trust Center
Security, data protection and data residency
Kisuno is operated in ISO 27001-certified data centres run by Green in Lupfig, Switzerland, while the language models run in the AWS data centre in Frankfurt or at European providers on servers in Europe. Every statement on this page is either substantiated or explicitly marked as in progress.
In short
- Conversations, files and accounts reside in ISO 27001-certified data centres run by Green in Lupfig, Switzerland. The certificates are held by Green, not by Kisuno.
- The current models from OpenAI (ChatGPT) and Anthropic (Claude) run in the AWS data centre in Frankfurt; AWS is a US company, so the US CLOUD Act applies there too, and we say so openly. For higher data-protection requirements, open frontier models such as GLM, Kimi and DeepSeek are available, operated by European companies on servers in Europe; the CLOUD Act does not apply there.
- Customer data does not train any models, and telemetry is switched off by default.
- Web search forwards search queries to external search engines without any user identity. “Everything stays in Europe” applies to storage and inference, not to the search query itself.
- Anyone who self-hosts Kisuno keeps all data on their own infrastructure. In self-hosted operation, all subprocessors are eliminated apart from the model providers you choose yourself.
Where your data resides
In operation managed by Kisuno, conversations, uploaded files, accounts and logs reside in ISO 27001-certified data centres run by Green in Lupfig, Switzerland. Depending on the model chosen, requests to the language models are processed in the AWS data centre in Frankfurt or at European providers on servers in Europe. Anyone who self-hosts Kisuno keeps all of this data on their own infrastructure.
| Data type | Managed operation | Self-hosted operation |
|---|---|---|
| Conversations and messages | Database in Lupfig, Switzerland | Database on your server |
| Uploaded files | File storage in Lupfig, Switzerland | File storage on your server |
| Accounts, roles and groups | Database in Lupfig, Switzerland | Your server, optionally fed from Entra ID |
| Audit logs | Database in Lupfig, Switzerland | Database on your server |
| Content of a model request | AWS data centre in Frankfurt (GPT and Claude) or European providers on servers in Europe (GLM, Kimi, DeepSeek), no storage at the model provider (exception: AWS abuse detection, see below) | Provider of your choice, with the access key held by you |
| Web search query | Own search instance, forwarded to external search engines without user identity | Your own search instance, same forwarding |
Operation in Switzerland
Managed operation of Kisuno takes place in the data centres run by Green in Lupfig, canton of Aargau, Switzerland, which are certified to ISO 27001. This certification is held by Green as the data centre operator, not by Kisuno. Swiss data protection law therefore applies to the stored data, namely the revised Federal Act on Data Protection.
Where the models compute
The language models do not run on the chat server but at the inference provider. Kisuno offers the current models from OpenAI (ChatGPT) and Anthropic (Claude); they run in the AWS data centre in Frankfurt. AWS is a US company, so the US CLOUD Act applies even with servers in Frankfurt, and we say so openly.
For customers with higher data-protection requirements, open frontier models such as GLM, Kimi and DeepSeek are available, operated by European companies on servers in Europe; the CLOUD Act does not apply there. Which models are enabled in your instance is set by your administration. If it additionally connects a provider outside Europe, it discloses that provider, and the European assurance does not apply to it.
Whatever model you choose: inputs and uploaded data are neither stored by the model provider nor used for training. This assurance is set out in the data processing agreement, in the section “No training on customer data”.
One exception we state openly: AWS automated abuse detection. It can flag messages, for instance on signs of attacks, malicious code or prohibited content. AWS retains flagged messages for up to 30 days with the GPT models, and all requests with Claude Fable 5 and 5.1, to review and stop misuse; for the other Claude models no retention is preconfigured. Retained data stays with AWS in the processing region; none of it is shared with the model providers or used for training.
What applies in self-hosted operation
In self-hosted operation, no content leaves your infrastructure apart from the model requests sent to the provider you have chosen. Database, search index, file storage and logs reside on your server, as do the access keys. All subprocessors are eliminated, except for the model providers you enter yourself. Kisuno is coming soon under the MIT licence, with no seat limit and no mandatory branding.
What does not happen to your data
Customer data does not train any models, telemetry is switched off by default, and there is no tracking without active consent. Two exceptions we state openly: AWS abuse detection in the section above and web search further below.
No training on your data
Customer data is not used to train models. This is set out in the data processing agreement and in the general terms and conditions of Kisuno, and, whatever model you choose, it also applies to the model providers: inputs and uploaded data are neither stored nor used for training there. The first of the two exceptions, AWS automated abuse detection, is named in the section “Where the models compute” above; the second, web search, is further below. A standalone no-training statement as a separate document is in progress.
Telemetry off by default
All platform components ship with telemetry disabled, including the search index and the chat application itself. The instance reports no usage statistics to third parties and is not released to search engines. This default applies in managed operation as well as in self-hosted operation and does not need to be switched off first.
Being honest about web search
Web search in Kisuno runs through a self-hosted search instance based on SearXNG. This instance forwards the search query to external search engines, without user identity, without an account and without profiling. The statement “everything stays in Europe” therefore applies to storage and inference, not to the search query itself.
Anyone who does not want this forwarding switches web search off in the admin panel. The rest of the platform continues to work without it. We name this point rather than glossing over it, because an assurance is only worth as much as its exceptions.
Which law applies to your data
Kisuno is subject to the revised Swiss Federal Act on Data Protection (revFADP) and to the GDPR, both contractually assured. For managed operation, customer and provider conclude a data processing agreement under Art. 28 GDPR. The subprocessors used are listed publicly and form part of that agreement.
What the revised FADP means here
Managed operation takes place in Switzerland and is therefore subject to the revised Federal Act on Data Protection. The provider of Kisuno is Herr Informatik GmbH, domiciled in Windisch, Switzerland. What is processed is the content that users enter into the service, as well as account metadata. The data subjects are the customer’s employees and contacts.
When the GDPR applies in addition
The GDPR applies in addition as soon as data of persons in the EU is processed. Kisuno processes personal data exclusively to provide the agreed service and only on documented instructions from the customer. Processing outside the EU, the EEA and Switzerland does not take place without appropriate safeguards.
Data processing and subprocessors
The data processing agreement governs the binding effect of instructions, confidentiality, support with data subject rights and notification obligations. It is available today as a complete structural preview; the signature-ready version is under legal review and therefore in progress. The list of subprocessors is part of the agreement: changes are announced in advance, and you can assert legitimate objections.
After the contract ends, customer data is exported on request and subsequently deleted, insofar as no statutory retention obligation applies. A retention period for conversations can be set freely in the admin panel; once it expires, content is removed together with its search index entries. Export and deletion of an individual person’s data is likewise carried out there by the administration, including full deletion for erasure requests. How this works in day-to-day practice is described on the Governance page.
Technical and organisational measures
The following measures are implemented in the product or are binding requirements for operation; they apply to managed operation as well as to self-hosted operation. Where a measure is set by the operator, the row says so. This overview is the current public version. A standalone TOM document as an annex to the data processing agreement is in progress and will be linked here as soon as it is available.
| Area | Implementation |
|---|---|
| Transmission | TLS for all connections. Certificates are issued and renewed automatically by the bundled reverse proxy. |
| Data at rest | The data resides on the operator’s machine. For managed operation, encryption of the storage media is part of server provisioning; in self-hosted operation it is the operator’s responsibility. |
| Access control | Roles and groups, with permissions down to individual tools. Evaluation follows this order: individual user, role, group, server default. |
| Behaviour on failure | If the permission check fails, access is denied, not granted. |
| Identity | Local accounts with invitation and a self-chosen password. Sign-in via Entra ID or another OIDC provider with role and group claims is supported by the platform and is set up per instance; anyone blocked there can no longer get in. Without a configured directory service, local user management applies. |
| Logging | Every tool call through the MCP gateway, every administrative action and every login is logged, continuously chained, tamper-evident after the fact and exportable. |
| Customer separation | One dedicated stack per customer with its own database, its own search index, its own file storage, its own configuration, its own network and its own inference key. None of this is shared between customers. This separation is a binding requirement for managed operation and is set when each instance is provisioned. |
| Code execution | Code generated by the user runs in a short-lived, isolated environment per session, with a dedicated network per customer and hard resource and time limits. |
| Software versions | The application image is pinned to its digest rather than to a moving tag; the remaining services run on fixed versions. A release is therefore a tested, reproducible combination. |
| Secrets | Credentials and keys are generated during installation, never reside in the source code and are separated per customer. |
| Backup | Backup per customer covering database, configuration and files. The same tool serves for restore and for migration to another server. |
| Server hardening | The setup script configures the firewall, automatic security updates and log rotation. For public operation, the chat service is bound to the local interface, so that only the reverse proxy is reachable from outside. |
| Auditability | The platform builds on LibreChat, which is publicly available under the MIT licence. Our own extensions will likewise be published under MIT, coming soon. Assurances can then be verified against the code and the configuration. |
Access is decided before the model
It is not the language model that decides which company data it may see, but a chain of rules ahead of it. Calls to a connected system run through the MCP gateway, which checks the requesting user’s permissions and logs the decision. Authorisations are possible per system and per individual tool: read invoices yes, read salaries no. Where the person’s identity is instead passed through to the target system, that system enforces its own permissions. How roles, groups, logging and budget interact in detail is described on the Governance page.
What is not yet implemented today
Three points are open and are named here rather than passed over. An egress proxy with an allow list for network access from the code sandbox is in progress. The strongest isolation level of the code sandbox requires virtualisation support on the server and is therefore not the default everywhere. Automatic provisioning and blocking of accounts via SCIM is planned; today blocking is handled through the directory service.
Certifications: where we stand today
Kisuno does not hold a certification of its own today. The ISO 27001 certification on which operation relies is held by the data centre operator Green in Lupfig. An ISO 27001 certification of Kisuno itself is in progress. A SOC 2 report is not available and is currently not planned.
This distinction matters for your own assessment: Green’s certification covers the data centre, meaning the building, power, cooling, physical access and physical security. It does not cover the application and its operation. For that layer, the self-declaration on this page applies today, backed by the contractual assurances and by the open code base LibreChat on which the platform is built.
Which documents you receive today
Four documents are available today: the data processing agreement, the subprocessor list, the privacy policy and the general terms and conditions. Four more are in progress and will be linked here as soon as they are available. Until then, we provide written information on each of these points on request.
Available today
- Data processing agreement: processing of personal data under Art. 28 GDPR and the revised FADP. Structural preview; the signature-ready version is under legal review.
- Subprocessors: current list of sub-processors, forming part of the data processing agreement.
- Privacy policy: handling of personal data under the revised FADP and the GDPR.
- General terms and conditions: contractual terms for use of the service, including the no-training assurance.
In progress, without a link
These four items do not yet exist as standalone documents and therefore appear without a link. As soon as one of them is available, it will be linked here. Until then, we provide written information on each point on request. Shorter answers to recurring questions can be found in the frequently asked questions.
- TOM document as an annex to the data processing agreement. The section Technical and organisational measures on this page is the current version.
- Hosting fact sheet on the data centre in Lupfig.
- No-training statement as a standalone declaration.
- Audit and access concept as a document.
Frequently asked questions
Is our data transferred to the USA?
No. Conversations, files and accounts reside in Switzerland, and model requests are processed in the AWS data centre in Frankfurt or at European providers on servers in Europe. Processing outside the EU, the EEA and Switzerland does not take place without appropriate safeguards. We say it openly: AWS is a US company, so the CLOUD Act applies even with servers in Frankfurt. Anyone who wants to rule that out chooses the open frontier models GLM, Kimi or DeepSeek at European providers. If your administration deliberately connects an additional provider outside Europe, this assurance does not apply to that provider.
Do the language models train on our company data?
No. Customer data does not train any models. This is set out in the data processing agreement and in the general terms and conditions, and, whatever model you choose, it also applies to the model providers: inputs and uploaded data are neither stored nor used for training. One exception we state openly: AWS abuse detection can flag messages, for instance on signs of attacks, malicious code or prohibited content. AWS retains flagged messages with the GPT models, and all requests with Claude Fable 5 and 5.1, for up to 30 days to review and stop misuse; none of it is shared with the model providers or used for training. A standalone no-training statement as a separate document is in progress.
Does everything really stay in Europe, including web search?
No, and we say so openly. Storage and inference remain in Switzerland and in Europe. Web search runs through a self-hosted search instance that forwards search queries to external search engines, without user identity. Anyone who does not want this switches web search off in the admin panel.
Is Kisuno certified to ISO 27001?
No. The ISO 27001 certification is held by the data centre operator Green in Lupfig, in whose data centres Kisuno is operated. It covers the data centre, not the application. An ISO 27001 certification of Kisuno itself is in progress; a SOC 2 report is not available.
What happens to our data if we terminate the contract?
After the contract ends, customer data is exported on request and subsequently deleted, insofar as no statutory retention obligation applies. In self-hosted operation the question does not arise: the data is on your infrastructure anyway, and backup and deletion are your responsibility.
Do we need a data processing agreement?
Yes, as soon as Kisuno is managed by us and personal data of your company is processed in the course of that. The agreement under Art. 28 GDPR and the revised FADP is available as a structural preview; the signature-ready version is under legal review. In self-hosted operation no data processing agreement with us is required, because no data flows to us.
Hold us to our word
Request access to the managed Swiss instance now, or run Kisuno on your own server. The GitHub repository under the MIT licence is coming soon, after which every assurance can be verified against the code.
Last reviewed: