Compliance

Transformics production data is hosted in a Supabase/Postgres environment in eu-central-1 (Frankfurt), shared by all organizations and isolated per organization by row-level security. LLM inference is a separate component: it uses Anthropic Claude through EU Bedrock inference routing. See /data-residency for the database, LLM inference, application hosting and third-party details.

The production database is in Frankfurt (eu-central-1) and LLM inference is routed only to AWS EU Regions. That does not cover every service: the application-hosting region has not been published yet, and some sub-processors, such as payment processing, may process data outside the EU. Each sub-processor and its location is listed on /legal/subprocessors, and a Transfer Impact Assessment is maintained in the CISO pack.

Transformics does not train or fine-tune any model on customer data. LLM calls go to Anthropic Claude models through AWS Bedrock EU inference profiles; there is no direct Anthropic API path. How Amazon Bedrock and Anthropic handle prompts and completions (retention, abuse monitoring, training use) is governed by their terms and is under legal review, so this answer makes no claim about it. The llm_calls audit table stores only a sha256 prompt hash, never the prompt body.

The published list is on /legal/subprocessors; the sub-processor summary below and the compliance attestation API come from the platform attestation. Adding or replacing a sub-processor triggers a 30-day advance customer notice per DPA §7.2.

The database (Frankfurt, eu-central-1) and LLM inference (AWS EU Regions through Bedrock) are EU-based for every organization by default, with no action required. Some supporting third-party services are not EU-only, so a commitment that every service processes data only in the EU needs a customer-specific enterprise assessment.

Not today. There is one production database, in eu-central-1 (Frankfurt), and no US or Turkey database option. LLM inference uses EU Bedrock routing for every organization; AWS Bedrock does not currently offer the Claude model families in an Istanbul region. The KVKK regulatory track is supported for assessment content.

Every LLM call writes an immutable row to llm_calls: feature, model, token counts, latency, status, cache_status, fallback_used, prompt sha256 hash. No prompt body is persisted.

An assessment report whose grounding against the scored data is low, or could not be measured, is held for human review: it is not delivered or downloadable until an administrator other than the person who ran the assessment approves it. Other reports are delivered without manual sign-off, and no setting yet requires review of every report. Other AI runs are logged with a review status for review after the fact. Every AI-rendered surface carries an AI-generated badge.

No. People-facing modules (workforce outcomes, voice-of-customer, customer-facing AI, CHRO executive view) ship a not for individual evaluation notice. Scores reflect aggregate organizational patterns, not individual performance.

Requests to access, export or erase personal data are tracked from start to finish with an audit trail. Erasure is in-place PII anonymization with a [REDACTED] marker on respondent fields. It also covers free-text answers (encrypted answers are overwritten without being decrypted), stored quotes and survey links, and it removes the person's user link from LLM-call records. Export links expire after 72 hours and are logged. Interview transcripts record a stakeholder by name rather than email address, so they are handled on request. Deleting a whole organization destroys its encryption key and removes its stored files. The PITR window propagates the redaction to backups within 30 days. See /privacy for the full DSAR flow.

Database backups follow a 30-day point-in-time-recovery window. Erasure propagates to backups within that window.

Every signed URL generated for a DSAR export or report download writes a row to the signed_url_audit table, bucket, path, expiry, requesting user and org, reason, closing the gap where a forwarded URL has no internal trail.

Prompts contain only the assessment context needed to score or narrate. Before a request leaves Transformics, the names the platform knows about, your own sensitive terms and detected contact details are replaced with placeholders, and no organization, user or profile identifier is sent with it. This is pseudonymization, not anonymization: people the platform was never told about, and the content itself, can still point to an organization. The llm_calls audit retains a sha256 hash, not the body. Anti-injection wrapping is applied to all untrusted document content; the model is instructed never to follow instructions inside an untrusted document block.

The AIGeneratedBadge component is mounted on the board pack header, executive-view header, QoQ-narrative card, and management-agenda header. Each badge links to /ai-governance for the full disclosure.

An assessment report with low or unmeasured grounding is held for human review until an administrator other than the person who ran the assessment approves it; other reports are delivered without manual sign-off, and no setting yet requires review of every report. Where governed agent actions are enabled, the person who ran the agent cannot approve its proposals and proposals expire after 14 days. Document-extracted high-impact claims are suspect-by-default, and a document-only upside cap applies. Every override is captured in the audit_log.

LLM calls go only to the EU Bedrock route. If it is unavailable, AI features fail closed instead of switching to another provider or a non-EU Region. The four-layer hallucination guard on the QoQ narrator falls back to a deterministic templated narrative when the LLM call fails or returns invalid output. The fallback is tagged fallback_used=true in the llm_calls audit row.