Security at Typewise
ISO 27001
Certified
GDPR
Compliant
EU Only
Data Hosting on AWS
0 Data
Used for External AI Training
Typewise Culture
Your data is never used to train our AI. This is our most important commitment. Typewise does not use your customer data to train AI models for other customers – ever.
No Cross-Customer Training
Your data stays within your own tenancy. We never pool customer data to improve base AI models used by others.
No Data Leakage
Conversations, tickets, and agent interactions are processed in isolation. Nothing flows between customer environments.
Your Model, Your Data
If you choose to fine-tune a model, it is trained exclusively on your data and deployed only within your environment.
Flexible privacy models
Flexible privacy models that adapt to your security needs — from real-time processing with zero data retention to configurable PII masking before any data reaches the AI. Built for regulated, high-sensitivity environments.
Zero Data Retention
The AI processes requests in real time and stores nothing afterwards. Ideal for highly sensitive data environments.
PII Masking Available
Sensitive personal data (names, card numbers, IDs) can be automatically masked before the AI ever processes it.
People & Processes
Security is embedded across our people and processes — from ISO 27001-aligned programs and regular audits to clear roles, ongoing training, and annual penetration testing.
Information Security Program
Our program follows the criteria set forth by the ISO 27001 Framework ‒ a widely recognized international information security standard.
Third-Party Audits
Our organization undergoes independent third-party assessments to test our security and compliance controls on a regular basis.
Third-Party Penetration Testing
We perform an independent third-party penetration test at least annually to ensure that the security posture of our services is uncompromised.
Roles & Responsibilities
Roles and responsibilities related to the protection of customer data are well defined. All team members must review and accept all security policies.
Security Awareness Training
Team members go through employee security awareness training covering industry standard practices such as phishing and password management.
Confidentiality
All team members are required to sign and adhere to an industry standard confidentiality agreement prior to their first day of work.
Background Checks
We perform background checks on all new team members in accordance with local laws.
Infrastructure & Data
Our cloud infrastructure is built with security at its core — hosted on AWS, with EU data residency, end-to-end encryption, continuous monitoring, and robust backup and incident response processes.
Cloud Infrastructure
All of our services are hosted with Amazon Web Services (AWS), which employs a robust security program with multiple certifications.
Data Hosting ‒ EU Only
All of our data is hosted on AWS databases located in the European Union. Your data stays in the EU.
Encryption at Rest
All databases are encrypted at rest, ensuring your data is protected even in the event of unauthorized physical access.
Encryption in Transit
Our applications encrypt all data in transit using TLS/SSL only ‒ no unencrypted connections are permitted.
Vulnerability Scanning
We perform continuous vulnerability scanning and actively monitor for threats across our infrastructure.
Logging & Monitoring
We actively monitor and log various cloud services to detect and respond to anomalies in real time.
Business Continuity & Disaster Recovery
We use AWS backup services to reduce any risk of data loss, with monitoring services that alert the team immediately.
Incident Response
We have a process for handling information security events which includes escalation procedures, rapid mitigation, and communication.
Identity & Control
Access is tightly managed through least privilege, enforced multi-factor authentication, and continuous logging — ensuring only the right people have access, and every action is tracked.
Least Privilege Access
Access to production systems follows the principle of least privilege ‒ team members only have access to the systems and data they need.
Multi-Factor Authentication
Multi-factor authentication (MFA) is enforced for all internal systems and cloud infrastructure access.
Access Logging
All access to production environments is logged and monitored. Access logs are retained and reviewed regularly.
Access Reviews
We conduct regular access reviews to ensure that access rights remain appropriate and are revoked promptly when no longer needed.
Third-Party Oversight
We carefully vet all vendors, enforce GDPR-compliant agreements, and continuously monitor their security — ensuring third parties meet the same standards we hold ourselves to.
Vendor Risk Assessment
All third-party vendors are assessed for security and compliance before being onboarded. We evaluate their security posture and certifications.
Data Processing Agreements
We maintain Data Processing Agreements (DPAs) with all vendors who process personal data on our behalf, in accordance with GDPR.
Ongoing Monitoring
Vendor relationships are reviewed on a regular basis to ensure continued compliance with our security and privacy standards.
Frequently Asked Questions
Does your AI read our sensitive customer data?
The AI only processes the data necessary to generate a response or perform an action. For highly sensitive environments, we offer PII Masking, which can automatically mask sensitive data such as credit card numbers before the AI ever processes it. We also offer a Zero Data Retention model where nothing is stored after processing.
We are not allowed to store data outside the EU.
That is not a problem. All of our data is hosted on Amazon Web Services (AWS) databases located exclusively in the European Union. Your data stays in the EU.
How secure is your infrastructure?
Our infrastructure is highly secure. We use AWS, which employs a robust security program with multiple certifications. All databases are encrypted at rest, and all data in transit is encrypted using TLS/SSL. We also perform continuous vulnerability scanning and annual independent penetration testing.
Is our data used to train AI models for other customers?
No, never. This is our core promise. We do not use your customer data to train AI models for other customers. Your data stays within your own tenancy, and there is no cross customer training or data leakage.
Which certifications do you hold?
Typewise is ISO 27001 certified, which is a widely recognized international information security standard. We are also 100% GDPR compliant and ready for the EU AI Act.
Which cloud provider do you use?
All of our services and data are hosted with Amazon Web Services (AWS).
Ready for a secure AI solution?
See how Typewise transforms your customer service, without compromising on data security or privacy.