Trust and transparency
This page states where your data goes, who processes it, and what leaves the European Union. It contains only verified facts about our servers — no intentions, no certifications we don't hold.
Facts measured on 29 July 2026.
Where your data is hosted
Our servers are hosted with IONOS, in Frankfurt, Germany — therefore within the European Union. Your website, catalogue and configuration data reside there and do not move.
Backups are encrypted and kept off the main server. Their restoration was tested and proven on 28 July 2026: this is not a theoretical procedure.
Who processes the conversations
A conversational assistant relies on language models. Here, plainly, are which ones and where they are located today.
| Use | Provider | Location |
|---|---|---|
| Written conversation (site demos and assistants) | Mistral | European Union |
| Written conversation (some client sites) | Mistral | European Union |
| Speech recognition (you speak) — French, English, German, Dutch, Portuguese, Hindi, Russian, Chinese, espagnol, arabe, italien, japonais, coréen | Voxtral — Mistral | European Union |
| Speech recognition (you speak) — other languages, and fallback if the European one fails | Whisper — OpenAI | Outside the EU (United States) |
| Speech synthesis (the assistant speaks) — French and English | Voxtral — Mistral | European Union |
| Speech synthesis (the assistant speaks) — other languages, and fallback if the European one fails | Outside the EU (United States) | |
| Authentication, if you choose « Continue with Google » | Outside the EU (United States) | |
| Hosting, website, catalogue, backups | IONOS / Scaleway | European Union |
Voice takes your data out of Europe in some languages — not in all of them. In French and English, speech recognition and speech synthesis go through Voxtral (Mistral) and stay within the European Union. In other languages, and in every language if the European engine fails and the fallback is used, what is said into the microphone and what is read aloud travels through American providers (OpenAI's Whisper, Google) and therefore leaves the European Union. The table above states, line by line, which use goes through whom. If you need a strict guarantee that nothing leaves, the assistant works perfectly in text only: voice is an option, never an obligation.
Where we stand, measured on 1 September 2026 and not merely claimed: the text of all our assistants now goes through a European engine (Mistral) — verified at network level on a real client call, with no outgoing connection to an American provider. The transcription of what you say is European in thirteen of the sixteen languages, up from eight. Two dependencies outside the European Union remain, and we name them rather than hide them: reading aloud in the fourteen languages other than French and English — the European voice catalogue covers only two, and making every language speak with a French accent would be worse than saying so; and transcription in Thai, Vietnamese and Hebrew, absent from that same catalogue. We will not claim this is settled until it is.
What we do not keep
Conversations serve to answer the visitor. We do not resell them, we do not use them to train a model, and we do not attach any advertising profile to them.
Server security
What is actually in place, and nothing more:
- TLS encryption on every page and every interface.
- Active firewall, exposing only the strict minimum.
- Process isolation (AppArmor) and automatic banning of abusive addresses (fail2ban).
- Administration interfaces protected by two-factor authentication, and for the most sensitive access by client certificate — without it, the server doesn't even respond.
- Encrypted off-site backups, restoration proven.
Compliance
European AI Regulation (AI Act, Article 50). Our assistants clearly tell the visitor that they are speaking to an artificial intelligence. This notice is displayed in all 15 languages offered, below the input field, in every conversation.
GDPR. The data collected is limited to what is necessary to respond. You can request to access, correct or delete it by writing to us — see below.
We claim no SOC 2 or HIPAA certification, because we have none. We would rather say so than let it be assumed.
What the assistant can do, and cannot do
An AI assistant sometimes gets it wrong. Ours answers from the information the establishment has provided it; beyond that scope, it must say it doesn't know rather than invent. It never replaces a professional: it makes no medical diagnosis, no legal advice, and no contractual commitment.
A question, an incident, a doubt
Write to support@koaee.ai. If you spot a security vulnerability, tell us directly: we would rather hear it from you than from a third party, and we respond.
This page is updated when the facts change. If you notice a discrepancy between what is written here and what you observe, report it: it is a mistake on our part, and we will fix it.