DeutschTrust Center
Security and privacy you can check
Where your data lives, who is involved and what the AI may do. For procurement, data protection and IT.
Service providers in Xenaxio Cloud
On your own servers none of them is involved; with your own model, Mistral is not involved either.
| Provider | Location | Purpose |
|---|---|---|
| Hetzner Online GmbH | Germany | Data centre: servers, database, mailboxes, files, chat |
| Cloudflare, Inc. | USA / EU network | TLS and attack protection for the web app and portals (email does not pass through Cloudflare) |
| Mistral AI | France (EU endpoint) | AI processing – not when your company uses its own model |
| Object store in the EU | EU | Encrypted backups (restic); the provider only sees encrypted data |
Data and AI
- LocationMailboxes, files, calendars, contacts, chat and the database on servers in Germany.
- No trainingYour content is not used to train AI models.
- Only what is neededThe AI reads only what your request needs.
- GuardrailsSends only for scheduled jobs you allow; deletes only its own drafts after you confirm; meetings only after you confirm.
Technical measures
- TLS for every connection; HSTS and a strict Content Security Policy
- Mailbox credentials encrypted (AES-256-GCM); assistant notes encrypted and invisible to admins
- Isolation between companies; sharing only within your company
- Usage statistics of the apps on our own server (Umami): no cookies or IP address, no names or content – only the area, company, product and role
- Pictures in the chat: checked by an AI model of our own on our server (XenRooms Free always, otherwise when the admin wants it); people only see flagged pictures, without text, channel or sender
- Audit log of every AI action, from the AI chat too, with CSV export
- Every AI chat connection with its own revocable key
- Sender addresses cannot be faked; sending limits per person
- Prompt-injection protection
- Daily encrypted backups, restore tested
- Open-source web client (AGPL-3.0), public on GitHub
On your own servers
For networks without internet, everything that goes outside can be switched off.
- AIYour own model in your network, for example Ollama or vLLM.
- CertificatesYour own CA or your certificates instead of Let’s Encrypt.
- PushCan be switched off; notifications then show while the app is open.
- Outside calendarsCan be switched off or limited to your network.
Contracts and contact
- Data processing agreement (Art. 28 GDPR): on request to [email protected]
- Found a vulnerability? [email protected] – see security.txt
- Provider: ESSOTEC, LLC – legal notice, about us
Questions
Which service providers are involved in Xenaxio Cloud?
Hetzner Online GmbH (Germany) runs the data centre: servers, database, mailboxes, files and chat. Cloudflare, Inc. (USA / EU network) provides TLS and attack protection for the web app and portals; email does not pass through Cloudflare. Mistral AI (France, EU endpoint) processes AI requests – not when your company uses its own model. An object store in the EU holds encrypted backups and only sees encrypted data. On your own servers none of them is involved.
Where is our data stored?
Mailboxes, files, calendars, contacts and the database live on servers in Germany. AI processing runs through the EU endpoint of Mistral AI, a French provider – or, if your company connects its own model, only on your own server.
Is the AI trained on our emails?
No. Your content is not used to train AI models. The AI only reads what your request needs, and every action is recorded in the audit log.
Is there a data processing agreement?
Yes. A data processing agreement under Art. 28 GDPR is available on request to [email protected].
Is Xenaxio open source?
The web client is: it is based on Bulwark Mail and published under AGPL-3.0 on GitHub. We run the platform behind it – administration, AI and the connection to AI chats – for you.
Ready for a sovereign workspace?
In our cloud or on your servers – we set up Xenaxio for your team.