Security and Trust
Trust is essential to responsible AI transformation
casaios asks organizations to bring their AI activity, governance decisions and workforce data into one platform. That only works if we are clear about how the platform is built, where data is processed and who is involved. This page describes our current position and is updated as the platform develops.
Data hosting
Customer data is hosted within the European Union.
Tenant separation
Each customer organization operates in its own logically separated environment.
Separation is implemented through separate database schemas per organization combined with row-level security.
Role-based access
Access follows defined roles, so employees, managers, expert functions and administrators see the information and actions appropriate to their responsibilities.
Audit and traceability
Key changes, decisions, approvals and reviews remain traceable within the platform, so governance records can be reconstructed rather than reassembled manually.
Subprocessors
Lovable Labs Sweden AB
- Purpose
- Website hosting, data storage and transactional email
- Note
- Sweden / EU, server location Europe
Supabase Inc.
- Purpose
- Application database and storage of order and process data
- Note
- Registered in the USA; data stored in an EU region. Access from the USA in the course of operations and support cannot be excluded.
HubSpot
- Purpose
- Customer relationship management and business communication
- Note
- Registered in the USA; server location Europe. Access from the USA in the course of operations and support cannot be excluded.
PostHog, Inc.
- Purpose
- Privacy-minimised website analytics and conversion measurement; loaded only after explicit consent; cookieless (in-memory) configuration, no autocapture, no session recording
- Note
- EU Cloud ingestion and storage. Technical request data (including IP address, user agent, timestamp) is processed as part of every request; IP capture must be disabled in the PostHog project privacy settings.
OpenAI
- Purpose
- AI assistant and AI-supported features
- Note
- Processing may occur outside the European Union
Make.com
- Purpose
- Workflow automation between business systems
- Note
- Processing may occur outside the European Union
OpenAI and Make.com process data for the casaios platform at app.casaios.ai, not for this website.
Data is stored within the European Union. Some subprocessors are registered in the USA, and access from outside the EU in the course of operations and support cannot be excluded. Where that applies, transfers rely on the EU standard contractual clauses set out in our data processing documentation.
Responsible AI
Customer data is not used to train models.
Content processed by the AI assistant is not used to train or improve the underlying models.
The assistant recommends, people decide.
The assistant prepares and explains. It does not approve its own recommendations or publish governance outcomes without responsible human review.
Human accountability stays assigned.
Every governed AI activity has a named owner, and assistant contributions remain visible alongside human decisions.
Legal documentation
Compliance documentation, including our data processing agreement, is available in the casaios trust portal.
Security contact
Report a security concern or suspected vulnerability to: info@casaios.ai
We take reports seriously and will respond. Please give us reasonable time to investigate before disclosing publicly.
For all other enquiries: info@casaios.ai
See how casaios works in your organization
Walk through the platform with our team, or ask a specific question about how casaios would fit your environment.