Skip to content
valiss AI
EN DA

Trust Center

Who processes data on our behalf, where, under which agreements, and what each of them can document.

Privacy notice Responsible AI See our data processing agreement
Trust Box ApS is the data controller
Valiss AI is operated by Trust Box ApS, CVR 37588822, Lyngbyvej 83 A, 2100 Copenhagen. Questions go to hello@valiss.co.
This site is hosted in the EU
valiss.co runs on Vercel in the Stockholm region. Our own systems and backups are hosted in the EU, and we choose EU regions wherever a provider offers one.
Transfers rest on standard contractual clauses
Where a subprocessor sits outside the EEA, the transfer is covered by the European Commission standard contractual clauses (SCCs), supplemented by our transfer impact assessment. Where a provider is also certified under the EU-US Data Privacy Framework we show it, but we do not rely on it alone.
A data processing agreement before we start
When we process personal data for a customer, we sign a data processing agreement first, based on the Danish Data Protection Agency standard clauses. The standard agreement is public, and Annex B lists the subprocessors used in that specific solution.

Subprocessors

Every third party that may process personal data when you use this website, order a Signal audit, or run a solution we have built. A customer solution uses only the ones it needs.

23 subprocessors

AI models

  • OpenAI

    Language models for conversations, drafting and analysis in customer solutions, and ChatGPT queries in Signal audits.

    Signal auditsCustomer solutions
    United States
    OpenAI OpCo, LLC
    EU entity: OpenAI Ireland Ltd.
    Transfer basis: standard contractual clauses
    SOC 2ISO 27001ISO 27017/18ISO 42001CSA STAR
    Data processing agreement Security and compliance Their subprocessors

  • Anthropic

    Claude models for conversations, drafting and analysis in customer solutions, and Claude queries in Signal audits.

    Signal auditsCustomer solutions
    United States
    Anthropic, PBC
    EU entity: Anthropic Ireland, Limited
    Transfer basis: standard contractual clauses
    SOC 2ISO 27001ISO 27017/18ISO 42001CSA STAR
    Data processing agreement Security and compliance Their subprocessors

  • Google Cloud (Gemini)

    Speech and language models (Gemini via Vertex AI) in customer solutions, processed in the EU region with no training and no retention after the reply; Gemini queries in Signal audits. Google Places for public business information; no guest or customer data is sent there.

    Signal auditsCustomer solutions
    United States · EU data region
    Google LLC
    EU entity: Google Cloud EMEA Limited
    Transfer basis: standard contractual clauses
    Customer solutions: contract with Google Cloud EMEA Limited (Ireland), regions eu and europe-west; data stays in the EU. Signal audit queries may be processed in the United States under the standard contractual clauses.
    SOC 2ISO 27001ISO 27017/18ISO 42001CSA STARPCI DSSEU-US DPF
    Data processing agreement Security and compliance Their subprocessors

  • Perplexity

    Queried in Signal audits to see how it describes a business. Only public information is sent.

    Signal audits
    United States
    Perplexity AI, Inc.
    Transfer basis: standard contractual clauses
    SOC 2ISO 27001
    Data processing agreement Security and compliance Their subprocessors

  • Mistral AI

    European language models in customer solutions, hosted in the EU by default.

    Customer solutions
    France · EU data region
    Mistral AI SAS
    Data stays in the EEA
    SOC 2ISO 27001
    Data processing agreement Security and compliance Their subprocessors

  • xAI

    Grok models in customer solutions where the customer chooses them.

    Customer solutions
    United States
    SpaceXAI LLC
    Transfer basis: standard contractual clauses
    Formerly X.AI Corp.; part of SpaceX since 2026.
    SOC 2
    Data processing agreement Security and compliance Their subprocessors

  • Meta (Llama)

    Llama open models, run on hosting listed on this page. Meta is the licensor and receives no data.

    Customer solutions
    United States
    Meta Platforms, Inc.
    EU entity: Meta Platforms Ireland Limited
    No personal data is sent

Voice and telephony

  • Cartesia

    Speech synthesis for voice agents.

    Customer solutions
    United States
    Cartesia AI, Inc.
    Transfer basis: standard contractual clauses
    SOC 2PCI DSS
    Data processing agreement Security and compliance

  • Twilio

    SMS gateway for alerts, links and confirmations, and email delivery (SendGrid) from customer solutions. Recipient number and content are processed during sending only; nothing is stored beyond the delivery log.

    Customer solutions
    United States · EU data region
    Twilio Inc.
    EU entity: Twilio Ireland Limited
    Transfer basis: standard contractual clauses
    Transfer under the European Commission standard contractual clauses (module 3), supplemented by our transfer impact assessment. Twilio is not used for telephony in current customer solutions.
    SOC 2ISO 27001ISO 27017/18PCI DSSEU-US DPF
    Data processing agreement Security and compliance Their subprocessors

  • FlyNumber

    Telephony provider for AI phone: the Danish phone number callers dial and the SIP trunk that carries the call from the telephone network to Valiss’ own SIP server in the EU. Processes calling number, called number and call metadata; audio passes in transit and is not stored.

    Customer solutions
    United States
    FlyNumber
    Transfer basis: standard contractual clauses
    Signalling and audio between FlyNumber and the SIP server are encrypted (SIP over TLS and SRTP). Transfer under the standard contractual clauses. No published certification.
    Data processing agreement

Hosting and infrastructure

Communication and operations

  • Twilio SendGrid

    Sends our newsletter and service messages, and email from customer solutions.

    This websiteCustomer solutions
    United States
    Twilio Inc.
    EU entity: Twilio Ireland Limited
    Transfer basis: EU-US Data Privacy Framework
    SOC 2ISO 27001ISO 27017/18EU-US DPF
    Data processing agreement Security and compliance Their subprocessors

  • Sanity

    Content system behind the Journal on valiss.co and content on customer websites. Content is stored in Belgium.

    This websiteCustomer solutions
    United States · EU data region
    Sanity US Inc.
    EU entity: Sanity AS
    Data stays in the EEA
    SOC 2
    Data processing agreement Security and compliance Their subprocessors

  • Telegram

    Message channel for notifications and simple bots in customer solutions, only where the customer chooses it.

    Customer solutions
    United Arab Emirates
    Telegram Messenger Inc.
    Transfer basis: standard contractual clauses
    Telegram publishes no data processing agreement. It is used only as a transport channel; the data a bot receives stays in our systems.
    Security and compliance

Payments

Analytics and marketing

Certifications are those each provider states publicly on its own trust or security page at the time of the last update. Links go to the provider’s own documentation, which may change. The privacy notice describes how we process your data as a visitor or customer; this page lists the providers in use today.

What the certifications mean

A certification says that an independent auditor has checked the provider against a published standard. It does not replace a data processing agreement, but it is the best public evidence of how the provider works.

SOC 2
SOC 2 Type II

An independent audit of security, availability and confidentiality controls over a period of at least six months, under the American AICPA framework.

ISO 27001
ISO/IEC 27001

The international standard for information security management. Certification means an accredited body has audited the provider’s security organisation.

ISO 27017/18
ISO/IEC 27017 and 27018

Extensions of ISO 27001 for cloud services. 27017 covers cloud security controls, 27018 covers protection of personal data in the cloud.

ISO 42001
ISO/IEC 42001

The first international standard for AI management systems: how an organisation governs the development and use of AI responsibly.

EU-US DPF
EU-US Data Privacy Framework

The provider is on the US Department of Commerce list, so personal data can be transferred from the EEA under the European Commission adequacy decision of July 2023.

PCI DSS
PCI DSS

The payment card industry standard for handling card data. Level 1 is the strictest tier, required of the largest payment providers.

CSA STAR
CSA STAR

The Cloud Security Alliance registry, where cloud providers document their controls against the Cloud Controls Matrix.

How we choose and manage subprocessors

  1. 01

    EU first

    Where a provider offers an EU region or EU processing, we use it. This site, our own systems and our backups are in the EU.

  2. 02

    Agreement before data

    We sign the provider’s data processing agreement and check its transfer basis before any personal data flows through it.

  3. 03

    Least access

    A solution gets access only to the systems and fields it needs, and an AI model only sees what the task requires.

  4. 04

    Notice of changes

    When we add or replace a subprocessor, we update this page and the log below. Customers with a data processing agreement are notified as that agreement sets out.

Changes

  • 27 Oct 2026 FlyNumber (phone numbers for AI phone) added, Stripe removed (not in use; payments run through QuickPay). Transfer basis clarified: standard contractual clauses, not the Data Privacy Framework alone. Terms of Service version 1.0, Product Terms and the standard data processing agreement published.
  • 15 Oct 2026 Microsoft Clarity added (heatmaps and session recordings on valiss.co, only after cookie consent).
  • 30 Sep 2026 Trust Center published.

Questions we get

Is our data used to train AI models?
No. We use the AI providers through their business and API terms, where the largest providers state that data sent through the API is not used for training. In valiss.ai, data is never used for training either.

Which subprocessors does our solution use?
Only the ones it needs. A voice agent might use Twilio, Cartesia and one AI model, nothing else. The exact set is listed in your data processing agreement, and you can ask for it at any time.

Can we get a copy of your data processing agreement?
Yes. Our standard agreement is public at valiss.co/dpa with Annexes A to D. Write to hello@valiss.co and we send a copy completed for your solution, or we review yours. We reply within one business day.

Where is our data stored?
Our own systems and backups are hosted in the EU, and in customer solutions voice and text are processed in EU regions. Only SMS, email and the telephony provider signalling pass through providers in the United States, under standard contractual clauses. In Signal audits the AI assistants process queries in the United States on the same basis, as shown for each provider above.

Need the details for your own review?

We send the data processing agreement, the transfer basis and the subprocessor list for your solution, and answer your security questionnaire.

Request the documentation Contact us