Where data is processed

Data you send to komplai is processed in one of four places. Which one a call uses depends on the tool, on what your organisation's agreement approves and on the processing the call asks for. A call is never moved to another place: a place or model that cannot be used is refused with an error that names it.

The four places

Place	Run by	Where	Data leaves the EU
komplai's servers	komplai, at Hetzner	Falkenstein, Germany	No
Local infrastructure	komplai	Denmark	No
EU cloud	komplai, through its EU model provider	France	No
Your own AI connections	Your organisation or its provider	Where the provider or your administrator states	Depends on the connection

komplai's servers run the hub, the API, Redact's rules, NER at the place eu-de, Register lookup and the databases. They are shared with other organisations.
Local infrastructure runs language models, Decide's decision models and NER at the place local. The queue is shared with other organisations, without priority. Processing on local infrastructure has no AI charge and does not count towards the monthly AI spending cap.
EU cloud runs language models for the tools your organisation has EU processing approved for, such as Chat, Coding and Redact's language model. Usage is metered at the provider's price and counts towards your organisation's monthly AI spending cap.
Your own AI connections are added by your organisation's administrator in the hub. The agreement with the provider is your organisation's own, the provider is not a komplai subprocessor, and the usage does not count towards the monthly AI spending cap. Chat, the Chat API and drafting in Documents, templates and Word can use them. Your own AI connections shows how.

Tool by tool

Redact

Redact processes the text you send in layers, and each layer has its own place:

Rules (regex) run on komplai's servers in Germany.
NER (ner) runs at the place in nerDeployment: eu-de is komplai's servers in Germany, and local is local infrastructure in Denmark when GET /v1/access lists it as available. Without nerDeployment, NER runs at the default place GET /v1/access marks.
The language model (llm) runs on local infrastructure in Denmark, unless the call asks for processing: "eu-cloud".

POST /v1/redact/detect runs rules and NER only. POST /v1/redact/restore runs no model. File input Beta extracts the text of a PDF or Word file in memory on komplai's servers in Germany and does not store the file. Then the text is processed like any other. POST /v1/redact/file/jobs stores the extracted text encrypted as a text job.

Redact in Word scans up to 16,000 characters of the document's main text through POST /v1/redact/detect, so it uses rules and NER at the same places. Headers, footers, footnotes, text boxes, comments, metadata and images are not scanned.

Chat

POST /v1/chat/completions sends the messages to the place in processing:

komplai-local: local infrastructure in Denmark.
eu-cloud: komplai's EU cloud, when your organisation has EU processing approved for Chat.
connection:<id>: one of your organisation's own connections that its administrator has made available through the API.

Without processing, the call runs where your organisation's Chat runs. The Chat reference has the fields and the errors.

Decide

Decide Beta sends the text and the questions to a decision model on local infrastructure in Denmark. On the way, the text is held in the encrypted queue described below; it is not stored after that.

Coding

Coding Beta sends what the coding client sends, messages and the results of tools the client ran, to a model in komplai's EU cloud on your organisation's approved route. komplai never runs a tool itself.

Register lookup

Register lookup Beta runs lookups in CVR, Retsinformation, Statistics Denmark and Folketinget on komplai's servers in Germany. The register you query receives the lookup parameters and has its own operating locations. No AI is used.

Run

Apps published with Run run in the visitor's browser, and Run runs no server code. The app files are stored on komplai's server at Hetzner in the EU; the hub's Data protection page names the place. An app that an administrator has approved for AI sends text to komplai's EU cloud or an approved AI connection, never to local infrastructure. Data an app saves in komplai is encrypted in komplai's database at Hetzner in Germany. Publish with Run has the details.

Tools without an API, such as Lens, Secret and Index, are listed with their processing on the hub's Data protection page.

What is stored, and for how long

What	Stored	For how long
Synchronous calls: Redact, detect, restore, file input, Chat completions and Decide	Nothing after the response, apart from the queue on local infrastructure	Not stored
Text sent to local infrastructure	Encrypted in the queue until it is processed, and the result encrypted in the queue after that	The result for 1 hour, then deleted by periodic cleanup, possibly later during an outage
Redact text jobs	The text, encrypted while the job is queued or running and cleared when the job ends, and the result, encrypted	Until you delete the job or it reaches `expiresAt`
Coding	No prompts, answers or tool results	Not stored
Chat conversations in the hub	The conversation, encrypted on komplai's servers in Germany and visible only to the person who had it	Until the person deletes it
Usage and audit records	Who, when, the tool, the model and token or character counts, without content	As your organisation's agreement states
Backups	A daily copy of komplai's databases, encrypted (AES-256) and kept at Hetzner in the EU, without files outside the databases	As agreed separately

A text job's retention counts from when the job ends. With test data and no storage policy, the result is kept for 1 hour. Personal data in text jobs needs a storage policy that your organisation agrees with komplai. It sets the retention, at most 30 days, and without it the job is refused with approved_redact_storage_policy_required. DELETE /v1/redact/jobs/{id} removes the text and the result at once. Reading a result does not delete it.

The model service in EU cloud

These are the terms of the model service behind komplai's EU cloud, as komplai last checked them on 13 October 2026. GET /v1/coding/account returns them, in Danish, in data.

The model service does not use input, prompts or answers to train, retrain or improve the base models.
Prompts and answers are not stored by default. A temporary, project-isolated cache of intermediate results is automatic and cannot be turned off.
During specific debugging or security incidents, including investigations of HTTP 500 errors, the whole request can be stored for up to two weeks.
Aggregated, anonymised usage data can be stored for up to six months.

Processing and retention also follow your organisation's agreement with komplai.

Check it for your organisation

GET /v1/access shows the processing for your key. For Redact, services[].hosting.processing.layers names where each layer runs, and the ner layer lists every place NER can run, each with available and a reason. services[].processing.data_mode says whether you may send personal data; Test data explains it.

Shell

curl https://api.komplai.dk/v1/access \
  -H "Authorization: Bearer $KOMPLAI_TOKEN"

In the hub, Data protection (/governance) lists your tools, or every tool in the agreement for an administrator, each with its processing, location and status. Each row says what is sent and stored, which data is permitted and which data processing agreement applies. When your organisation has data processing agreements, the page has them as PDF files, and administrators also see the platform backup. On Organisation › AI and processing › Processing (/settings/processing), an administrator chooses which of the approved places each tool may use. Processing approval explains both pages.

When a place cannot be used

A call names its place, or uses the default your organisation set, and it runs there or not at all. The API never switches to another place or model, also not when the chosen one fails or a cap is reached. These are the errors you meet most often:

processing_not_enabled: EU processing is not approved for the tool in your organisation.
processing_choice_not_allowed: your administrator does not allow this place through the API, or has not made the connection available through the API.
ner_location_unavailable: the NER place you named cannot be used right now.
eu_cloud_refused: komplai's EU cloud refused the call.
ai_credit_exhausted: your organisation's monthly AI spending cap or its own lower limit is reached. Local infrastructure keeps working.
connection_failed: the provider behind your own connection could not be reached.