Processing approval

A tool works for a person, in the hub or through the API, only when three things are in place:

Your organisation's agreement with komplai covers the tool and approves where it may process data.
Your administrator allows that place for the tool.
The person has access to the tool.

komplai records the agreement. Your administrator reads it in the hub and handles the other two.

What the agreement approves

The agreement names the tools your organisation has, the places each tool may use and the data you may send:

Places. Local infrastructure in Denmark, and komplai's EU cloud for a tool where the agreement has it. Where data is processed describes each place.
Data. Test data by default. Personal data needs a data processing agreement that is active and selected on the agreement. Test data shows how a key reads this.

The hub never offers a place or a tool that the agreement does not have. To approve more, such as EU cloud for a tool or personal data, your organisation agrees it with komplai. Contact us.

Read the approval under Data protection

Every member can open Data protection (/governance) in the hub's menu. Administrators see every tool in the agreement; members see the tools they have access to.

Sign in to the hub and open Data protection.
Under Data processing, find the tool. Its row shows Processing, Location and Status: Set up, Not set up or Turned off.
Open the row. It says what is sent and what is stored, and lists Permitted data (Test data only or Personal data under the data processing agreement) and, where they apply, the Request limit and the Data processing agreement.
Under Data processing agreements, open an agreement with Preview PDF or Download PDF. Each one shows its version, the date it was signed and a Checksum (SHA-256) you can compare with your own copy.

Administrators also see the platform backup on the page, and a link to the processing choices.

Choose which places each tool may use

On Organisation › AI and processing › Processing (/settings/processing), an administrator chooses which of the approved places each tool may use. The page only narrows the approval: it never adds a place, changes the agreement or adds a connection.

Open Organisation in the menu, then AI and processing. Processing is the first tab.
Each tool has two columns. In komplai covers the tool's workspace in the hub. Through the API covers calls with an API key; a tool that has no API says so.
Tick the places the tool may use: Local infrastructure and, where the agreement has it, EU cloud.
Select Save choices. Saved appears when the server has stored them.

For Redact, the choices are about the language model: Without an LLM, or with the LLM on local infrastructure and With the LLM in the EU cloud. Through the API, Redact's rules and NER at the place eu-de run on komplai's servers in Germany, and NER at the place local counts as local processing.

What the choices mean:

With no place ticked in a column, new processing stops there. Tasks are never moved to another place, and the AI usage limits still apply.
Through the API, a call that would run at a place your administrator has not ticked is refused with processing_choice_not_allowed. It is never sent somewhere else.
Until an administrator saves choices for a tool, every approved place is allowed.
The choices cover komplai's processing. Your organisation's own AI connections have their own switches on the Connections tab; see Your own AI connections.
Every change is written to the organisation's Audit log (/settings/audit).

Only the organisation's administrators can change the choices. komplai's read-only support access cannot open the page.

Give people access

On Organisation › People › Tool access (/settings/apps), tick a tool for a person, or for Everyone. Each tick is saved straight away.

Removing access also removes it from the person's API keys.
A tool marked Turned off is off for the organisation: you can remove access, but not give new access.
Guests do not get tools.

People with access create their own personal API keys (kp_live_...) under APIs and integrations › API keys (/api-access), with the scopes the connection needs. API keys and authentication explains keys and scopes.

Local models

On Organisation › AI and processing › Local models (/settings/local-models), an administrator chooses which of komplai's validated models on local infrastructure the organisation uses, and the default model for each task. People choose among the models that are switched on, or among every validated model when none is switched on for a task. The tab is there when the organisation has Chat or Decide.

How the API checks it

The API checks the agreement, the administrator's choices, the person's access and the key's scopes on every call, and again while a text job runs. When something is withdrawn, the next call stops with one of these codes:

Code	What happened
processing_not_approved	The organisation's processing approval for the tool is missing or was withdrawn.
processing_not_enabled	The place is not approved for the tool, for example EU cloud.
processing_choice_not_allowed	Your administrator does not allow the place through the API.
app_not_assigned	The person behind the key lost access to the tool while the call was admitted.
insufficient_scope	The key lacks the scope, its person no longer has the tool, or the approval no longer covers it.
processing_access_withdrawn	A text job lost its access after it was created. The job is invalidated and its text and result are deleted.