NL
EU data residency
All tenant databases — metadata and records — are hosted in the Netherlands. Your data doesn't leave the EU just because you use the platform.
OrganiseYou runs on servers in the Netherlands. The AI that reads and drafts inside your tenant is Mistral — a European provider, on European infrastructure. Not an afterthought: it's how we built it.
Hosting
EU data residency is how the platform runs — not a plan you have to buy.
All tenant databases — metadata and records — are hosted in the Netherlands. Your data doesn't leave the EU just because you use the platform.
Every organisation gets its own databases. No shared tables, no cross-tenant queries; a request without a tenant context fails closed.
Per-column encryption, sensitive fields masked before a prompt leaves your tenant, and a per-tenant audit log of every AI interaction.
Export your metadata and records at any time. No lock-in as a retention strategy.
Where your data lives
Netherlands (EU)Accounts, organisations and platform configuration — one central database.
Entities, forms, grids and processes — a separate metadata database per organisation.
Records and executions — an isolated document store per organisation.
Our application and platform databases are hosted in the Netherlands on UpCloud infrastructure. UpCloud publishes its security, privacy and compliance information.
UpCloud compliance & security (UpCloud)We use Brevo to deliver service emails. Brevo describes its data security measures and EU data hosting on its website.
Brevo data security (Brevo)AI
The AI the platform runs itself is European. Every path that isn't, is a path you chose.
Platform AI runs on Mistral — a European provider. The default model is mistral-medium-latest, set per platform. The application, hosted in the Netherlands, calls Mistral; prompts and responses stay with a European processor.
Builder chat: describe your app and the AI drafts the data model. AI onboarding: a first data model from a plain-language description.
Encrypted and sensitive columns are masked before a prompt is sent. Every resolved prompt and response is in your per-tenant audit log, and writes ask for human confirmation.
AI agents go through the same permission checks as a normal user — no more, no less.
AI use is limited per organisation per day, counted before the provider is called.
Mistral, EU — masked and audit-logged by the AI gateway.
The LLM you connect — ChatGPT, Claude, Grok… We expose the tools; you choose the assistant.
Wherever your provider runs. OpenAI and Anthropic are not EU-hosted; a tenant that configures them opts in knowingly.
The platform's own AI is European. Every path that isn't, is an explicit choice you made — never a default.
All tenant databases run on servers in the Netherlands. Metadata and records are in separate, isolated databases per organisation.
Not by us: the platform and its own AI (Mistral) stay in Europe. The exceptions are choices you make explicitly — connecting your own chat assistant via MCP, or configuring your own AI provider keys.
Encrypted and sensitive columns are masked before a prompt leaves your tenant, and every prompt and response is in your audit log. AI use is capped per organisation per day. Want AI off for your organisation entirely? Contact us.
You can export your metadata and records at any time — also on the way out. No lock-in as a retention strategy.
Only members of your organisation, through roles and permission checks. Every organisation has its own isolated databases; a request without a tenant context fails closed.