Trust & Compliance

Every vertical we build on the talari.ai platform handles sensitive professional data — session notes from therapists, case files from lawyers, patient records from vets. Under the GDPR, much of this is special-category data (Art. 9), with stricter protections than ordinary personal data.

This page tells you, in concrete terms, where data lives, who can touch it, what we will do if something goes wrong, and which commitments are already in place versus on the roadmap.

If anything on this page is unclear, or if you need a copy of our DPA / AVV before signing, contact us at trust@talari.ai.

Audit trail. Once region-pinning is live, each request that touches sensitive professional data will be logged with the region of every component that handled it. Logs are retained per the retention schedule in our DPA / AVV.

KMS region-locality statement. No customer-content key is ever materialised, wrapped, or used by a service running outside the EU. This is enforced at the IAM and network layers as part of the region-pinning architecture.

We will not display badges for certifications we have not yet earned. When SOC 2 Type II is issued, the audit-firm name, attestation-period, and report-availability path will appear here.

We follow the GDPR Art. 33 / Art. 34 framework.

Entries marked pending have Art. 28 AVV/DPA drafted and are awaiting signature; entries marked proposed are not yet finalised. No sub-processor is engaged until all onboarding steps in our registry process are complete.

Registry state: 0 engaged · 2 pending · 5 proposed · 0 terminated.

Notification SLA on changes. We will notify controllers at least 30 days before any new sub-processor begins processing customer-adjacent data, and at least 60 days before any change that affects the data-residency region.

We will not assert “we have a DPO” until the contract is executed. This page is updated within 5 business days of execution.

We do not treat the DPIA as a paperwork exercise filed once and forgotten. The talari.ai platform is built DPIA-first: every architectural decision that touches professional-session content is evaluated against a residual-risk register before merge.

The full DPIA (Art. 35 GDPR) is maintained internally and made available on request under NDA.

Headline findings from the v1 DPIA:

• No high-risk residuals requiring Art. 36 prior consultation with a supervisory authority.
• The single residual above Low is the quality risk that an AI-generated draft might be inaccurate — mitigated by the architectural commitment that the professional is always the author of record: no draft is filed without the professional's explicit review and approval.
• Lawful basis (Art. 6 / Art. 9):controller-side basis is the professional's service relationship and, where applicable, the client's explicit consent (Art. 9(2)(a) / Art. 9(2)(h)). Our processor-side activity is governed solely by the DPA / AVV — we do not process professional content for our own purposes.
• No secondary use.Professional-session content is never used to train, fine-tune, or evaluate any model — neither ours nor a sub-processor's. This is a contractual term with each LLM sub-processor and a hard architectural rule.

Zero US sub-processors handle raw customer-adjacent content.

This is a categorical commitment, not a best-effort statement.

• All LLM inference on raw professional-session transcripts is performed by an EU-region commercial API under a contract that prohibits training on customer data and prohibits retention beyond the request lifecycle.
• All primary and secondary infrastructure is operated by EU-headquartered providers in EU data centres under EU jurisdiction.
• The few US-headquartered SaaS tools we may use (e.g. internal collaboration / observability) do not receive raw session content and are scoped under appropriate Standard Contractual Clauses with supplementary measures per EDPB Recommendations 01/2020.
• Where a US-headquartered tool offers an EU-data-residency tier, we use that tier in preference to a non-EU one, even at higher cost.
• We monitor adequacy decisions and Schrems-style litigation; if the EU–US Data Privacy Framework is invalidated again, the architectural commitment above means our professional-content data flow is unaffected.

• General trust questions: trust@talari.ai
• Co-build and partnership enquiries: build@talari.ai
• Subject-rights requests (Art. 15–22): trust@talari.ai (will route to dpo@talari.ai once the DPO firm is contracted)
• Security disclosure: security@talari.ai (PGP key published once the security mailbox is provisioned)
• Postal address: pending entity registration in Poland