GDPR · EU data storage · WCAG 2.1 AA

Security, data protection & accessibility

Security is the top priority. Chattassistent is built with data protection at its core: all customer data is stored inside the EU, encrypted to the same standards banks use, and every customer is fully isolated from every other. Here we set out openly exactly how we handle your data and your customers' data, where it is stored, and how we work with accessibility.

The service is operated by oqpo group AB (company no. 559340-1986), Sweden.

GDPR

Full GDPR compliance. A data processing agreement (DPA) is signed with every customer. Data subjects have their full rights.

All data inside the EU

Customer data is stored and processed inside the EU – on servers in Ireland. Encrypted at rest (AES-256) and in transit (TLS). No data is ever sold.

Accessibility (WCAG)

We work towards WCAG 2.1 level AA. The widget supports keyboard use, ARIA, focus handling, contrast and reduced motion.

Data protection & GDPR

  • ✔ We comply with the EU General Data Protection Regulation (GDPR) throughout the service.
  • ✔ Data processing agreement (DPA) is signed with every customer – contact us and we'll send it for signature.
  • ✔ Data subjects have their full rights: access, rectification, erasure, portability and objection.
  • ✔ We never sell personal data and don't share it for marketing.
  • ✔ Full details are in our privacy policy.

Where is the data stored?

  • ✔ All customer data (accounts, conversations, leads, training content) is stored inside the EU – on servers in Ireland (Supabase, EU region).
  • ✔ Encrypted at rest with AES-256 and in transit with TLS – the whole way.
  • ✔ Every customer is fully isolated at database level (Row Level Security) – no customer can reach another customer's data.
  • ✔ You own your data and can export or delete it at any time. We never sell data on.

How we protect the data

Security isn't bolted on afterwards – it's built into the whole service:

  • ✔ Encryption at every step – AES-256 at rest, TLS in transit. The same encryption standards banks use.
  • ✔ Customer isolation at database level (Row Level Security) – a technical guarantee, not just a setting.
  • ✔ Passwords are never stored in plain text – they are hashed securely by our authentication platform.
  • ✔ Card details never touch our systems – all payment is handled by Stripe (PCI DSS certified). We never see your card number.
  • ✔ The widget is domain-locked – your configuration can only load from your own approved domains.
  • ✔ Continuous security review – we regularly go through the whole codebase to find and fix weaknesses, most recently a full review in August 2026.

Sub-processors & AI processing

We're transparent about which providers process data on our behalf:

  • ✔ Supabase – database, files & hosting (EU, Ireland).
  • ✔ Anthropic (Claude) – generates the AI answers. Messages are never used to train AI models.
  • ✔ OpenAI – semantic search across the knowledge base (embeddings). Is never used for model training.
  • ✔ Stripe – payments (PCI DSS certified). Resend – outgoing email. Cloudflare / Vercel – hosting for the site & widget.
  • ✔ The AI processing itself happens at Anthropic/OpenAI in the US under the EU Standard Contractual Clauses (SCC) – the storage of your data stays in the EU.
  • ✔ All sub-processors are bound by data processing agreements and handle data in line with GDPR. A full sub-processor list is available on request.

Accessibility statement

We want Chattassistent to be usable by everyone, whatever their ability.

  • ✔ We work towards WCAG 2.1 level AA in both the chat widget and the web interface.
  • ✔ The chat widget supports keyboard navigation, ARIA labels and clear focus handling.
  • ✔ Readable colour contrast and support for the operating system setting "reduce motion".
  • ✔ Semantic HTML and structure that works with screen readers.
  • ✔ We improve accessibility continuously. Run into a barrier? Email info@chattassistent.se and we'll fix it.

Need documentation?

We're happy to send the following on request – just get in touch at info@chattassistent.se:

  • 📄 Data processing agreement (DPA) – ready to sign.
  • 📄 Sub-processor list – a complete list of providers that process data.
  • 📄 Security overview – a technical summary for your procurement or security review.

If you have further questions or need other documentation ahead of a purchase – contact us and we'll send it.