Security and compliance

Where your data is

Thuul is hosted at Hetzner in Germany (EU). Files, chats, transcripts and tool data are stored there. You can also install Thuul on your own servers, and Swiss hosting is available on request.

Backups are encrypted before they leave the server and are kept in Switzerland at Infomaniak. They are kept for 30 days, then deleted.

You decide which AI sees what

Your IT team chooses which AI providers and models are available. That choice decides where AI requests go.

• Included for pilots: AI through Microsoft Azure AI Foundry, in the EU/Switzerland data zone.
• Your own keys: your organization can add API keys, for example for OpenAI, Anthropic or Google. Requests then go to that provider under your own contract and responsibility.
• Your own hardware: with local models, AI processing stays in your network.
• Security levels decide which model may read which content. Strictly confidential material only reaches models approved for it.

Connected systems

Connectors to Microsoft 365, Notion, Jira, Confluence and other systems are switched on by your administrators. People sign in with their own accounts.

Each company is separated

Every organization's data is separated in the database by row-level security. The application's database account cannot switch this off, and the server refuses to start if it could. If you need more, you get your own installation.

Tools your people build run in an isolated sandbox. They use the platform's sign-in, access rules and approved models, and load all their code from the platform, never from a third-party CDN.

Every tool moves through three stages: Develop (private), Beta (selected testers) and Production. Everyone can build tools for themselves; sharing them with others takes the Builder role or an approved publish request.

Encryption

All connections use HTTPS. Stored credentials, such as AI provider keys and connector tokens, are encrypted with AES-256-GCM. Offsite backups are encrypted before upload.

Sign-in and access

People sign in through Thuul's sign-in service or with single sign-on through your Microsoft Entra ID. Accounts can be created and removed automatically with SCIM. Self-registration is off; administrators add people. Two-step verification is available, and administrators can require it. Repeated failed sign-ins are slowed down.

People see what their spaces, groups and shares give them. Administrators manage people and tools without opening content. To open content, for example when someone leaves, an administrator signs in again, gives a reason and gets 30 minutes. Each start and end is logged.

Activity log

Important actions are logged: who did what, and when, from sign-ins and sharing to roles, tools and settings. Administrators can export the log. The application can add entries but cannot change or delete them. Entries are kept for 365 days by default.

Your data, your rules

You set how long AI chats are kept. People can delete their own chats, notes and files. Administrators can remove members, delete content, and export or erase one person's data in one step.

We do not use your data to train AI models. We do not sell it.

Documents on request

Write to info@thuul.ai for:

• Data processing agreement (DPA) under the Swiss FADP and the GDPR
• Technical and organisational measures (TOMs)
• List of subprocessors

What we are still working on

We prefer to say this plainly.

• Penetration test: an external test is planned. We will publish the date and a summary here.
• Certifications: Thuul holds no ISO 27001 or SOC 2 certification yet.

Report a vulnerability

Please write to info@thuul.ai. We reply within three business days. Our contact details for researchers are also in security.txt.