Log inBook a demo

Trust

Security and privacy

Colos is built for the documents consultants cannot afford to leak. This page explains, in plain words, how we handle your data.

What we commit to

  • No training on your data

    We never train models on your data, and our AI providers’ terms rule it out too.

  • Your data, your control

    Delete anything, any time; we keep no copies. Ask us and it is gone within 30 days.

  • Stored in the EU, encrypted

    Documents, accounts and outputs stay in the EU. TLS in transit, AES-256 at rest.

  • Separated per customer

    Row-level security keeps every organisation’s data apart.

  • Access controls

    Roles per organisation, sharing per project and two-factor authentication.

  • Independent testing

    An external penetration test in 2026, and automated security scans on every code change.

Security questions

How is customer data protected?

Your data is encrypted in transit (TLS) and at rest (AES-256), stored in the EU and kept apart per customer with row-level security. Access is limited by roles and two-factor authentication; only you and the people you share with can see your work.

Do you train on our data?

No. We never train models on your data, and our AI providers’ terms do not allow them to either.

Do AI providers keep our data?

They process each request and keep logs only briefly for abuse monitoring (typically up to 30 days), then delete them. Colos stores the data you put in the product so we can run the service, until you delete it.

What access controls do you support?

Roles per organisation, sharing per project and two-factor authentication. Our own access to customer data is restricted and least-privilege.

How do you test security?

An external penetration test in 2026, whose findings we fix, plus automated code, secret and dependency scans on every change.

Privacy

Last updated: 15 October 2026

In short

  • Your data stays yours. We don’t claim ownership of anything you upload.
  • No model training. Our AI providers never train models on your data.
  • Stored in the EU, encrypted in transit (TLS) and at rest (AES-256).
  • Separated per customer with row-level security.
  • You stay in control. Delete anything, any time. We keep no copies.

AI providers

We use commercial and enterprise APIs from AI providers. Your content is sent over a secure API, processed and returned. Under the providers’ terms it is not used for model training; they keep logs briefly for abuse monitoring (typically 7–30 days) and then delete them.

Where your data is stored

Documents, account data and outputs are stored in the European Union. Some AI processing partners are based in the US; our Data Processing Agreements with them include Standard Contractual Clauses for GDPR-compliant transfers.

Who can see your data

Only you and the people you share with. The founders have restricted, least-privilege access, used only to improve Colos. We never share or use your data for anything else.

Keeping and deleting data

We keep your data until you delete it. Deleted documents are removed from our systems. You can delete data in the platform, or ask us and we handle it within 30 days.

Analytics and demo requests

We use EU-hosted, cookieless analytics for page views and feature usage, with anonymised IP addresses; our own team is excluded from the in-app analytics. When you book a demo, we use the details you give us only to arrange it.

Agreements and incidents

A Data Processing Agreement (verwerkersovereenkomst) is in preparation; if you need one now, ask and we will prioritise it. We are implementing incident-response procedures in line with the GDPR.

Contact

Questions? niek.simons@colos.ai · Colos AI B.V., the Netherlands

See Colos on your own work

Book a demo