Your data stays yours. Period.
Security by architecture, not by declaration. European hosting of the platform core, full encryption (TLS in transit, AES-256 at rest), zero training on customer data, granular roles on every resource.
ISO/IEC 27001 — the international standard for information security: how data, access and systems are protected.
ISO/IEC 42001 — the first standard for AI management systems: how risks, transparency and human oversight are governed.
How we protect your data and your customers' data.
European hosting
All data can be hosted exclusively on European servers. GDPR compliance guaranteed by architecture, not by goodwill.
Full encryption
TLS 1.2+ with TLS 1.3 preferred in transit, AES-256 at rest on database, storage and backups. OAuth2 tokens and MCP credentials encrypted at rest.
Zero training on your data
Your agents' conversations are never used to train third-party AI models. Your data stays yours.
Granular roles and permissions
Owner / Admin / User system with configurable visibility on credentials, analytics, logs and MCP configurations.
MCP with enterprise security
Model Context Protocol servers with Basic / API key / Instance auth, manifest → workflow → user hierarchy.
Full audit trail
Every execution, every session, every scheduled job is tracked. Logs accessible from the admin panel.
Three privacy levels, by plan.
Every AI model is classified by privacy level. The highest level available depends on the plan you subscribe to: within the level your plan includes, you decide which models are allowed for your agents, based on your industry and data sensitivity.
ModelMatch™ Privacy Tiers
| Tier | Name | Description | LLM processing | Included from |
|---|---|---|---|---|
| 0 | Standard SaaS | All LLM providers. Automatic optimization for performance and cost. | Variable, possibly outside the EU (with SCC and no-training clauses) | All plans |
| 1 | EU Resident | Only providers with EU-based servers (Google Vertex AI EU region, Azure OpenAI North Europe, AWS Bedrock EU inference profiles). | Guaranteed in the EU | From Grow |
| 2 | Private Cloud | EU providers on cloud dedicated exclusively to the Customer. Maximum data segregation. | EU, dedicated infrastructure | From Scale |
| 3 | Local LLMcoming soon | Inference on the Customer's own hardware: dedicated machine or VPS running the BlueSky inference engine. | On the Customer's infrastructure | Coming soon |
"EU hosting" refers to the platform core (application, database, storage, backups), always within the European Union. Prompt processing by LLM models follows the privacy level included in your plan.
Sovereign Cloud (AWS European Sovereign Cloud)
Infrastructure in Germany, operated by independent European legal entities with EU-only personnel. Designed for public sector and customers with data sovereignty or CLOUD Act requirements.
Open-weight models on dedicated GPUs
Open-weight models running on GPUs dedicated to the Customer: no model vendor in the data path. The recommended setup for the strictest requirements; cost and sizing tailored per project.
Built on enterprise cloud at global scale.
The BlueSky Agent AI platform runs on Microsoft Azure and Google Cloud Platform — the same infrastructure powering Fortune 500 mission-critical applications worldwide.
'/%3e%3cpath%20d='M14.5%203.2%2020.7%2020.8H10.4l1.7-3h5.6L13.4%205.7l1.1-2.5z'%20fill='url(%23az2)'/%3e%3c/svg%3e){kind=small}
Kubernetes cluster, storage and Azure OpenAI Service in the North Europe region, with GPT in the versions available for EU deployment. Infrastructure certified ISO 27001 and SOC 2. BlueSky architecture aligned with ISO/IEC 27001 (certification in progress) and GDPR-compliant by design.
Gemini models via Vertex AI in the EU region, in the variants with verified EU support, and Anthropic Claude via Vertex AI's EU multi-region endpoint. Data and prompts processed within EU member states.
Azure credits, development tools and technical resources to accelerate innovation.
Google Cloud Platform credits and dedicated technical support for AI startups.
Microsoft, Microsoft Azure, Microsoft for Startups and Founders Hub are registered trademarks of Microsoft Corporation. Google, Google Cloud, Google Cloud Platform and Google for Startups are registered trademarks of Google LLC. BlueSky Agent AI S.r.l. is an independent member of the respective startup programs and is not affiliated with, sponsored or endorsed by Microsoft Corporation or Google LLC.
Personal data management, transparently.
How the BlueSky Agent AI Platform works from a data processing standpoint, under GDPR. Architecture, roles, retention, sub-processors, security measures.
Personal data flow
From user prompt to agent response: every component, its location, its role. The entire core runs on Microsoft Azure North Europe; only the external LLM provider varies based on the chosen privacy tier.
Data Protection roles
Determines purposes and means of processing. Configures permissions, defines retention instructions, is responsible for training users on the correct use of the Platform.
Processes data on behalf of the Controller pursuant to art. 28 GDPR, on the basis of the signed DPA. Appoints LLM providers as sub-processors.
Data categories and retention
BlueSky does not process special categories (Art. 9 GDPR) unless agreed in writing.
| Category | Retention | Deletion |
|---|---|---|
Identification data first name, last name, business email | Duration of contract | Deleted within 30 days after termination |
User conversations inputs sent to the Agent | Per Controller instructions (default 12 months) | Full deletion within 30 days |
Knowledge base uploaded company documents | Duration of contract | Automatic deletion within 30 days |
Technical metadata user ID, tokens, LLM used | 36 months | Anonymization after retention |
Access data IP, login timestamp, browser | 24 months | Automatic deletion at expiration |
Infrastructure stack
All components run on Kubernetes clusters hosted onMicrosoft Azure — North Europe.
Microsoft Azure — North Europe.Users, Agent configuration, execution logs
Document embeddings for RAG (Retrieval Augmented Generation)
Sessions, temporary cache, job queue
Workflow definitions, execution logs
Model routing, token usage logging
Documents, logos, media
Sub-processors and LLM providers
All appointed pursuant to Art. 28 GDPR. Data transits through LLM providers but is not retained.
| Provider | Service | Location | Active in tiers | Guarantees |
|---|---|---|---|---|
OpenAI L.L.C. | GPT — text (direct API) | USA | Tier 0 only | DPA + SCC · No training |
Anthropic PBC | Claude — text (direct API) | USA | Tier 0 only | DPA + SCC · No training |
Google Cloud Vertex AI | Gemini (variants with EU support), Claude via EU multi-region endpoint | EU | Tiers 0 · 1 · 2 | — |
Microsoft Azure | Kubernetes hosting, Azure OpenAI (GPT versions with EU deployment) | EU (North Europe) | Tiers 0 · 1 · 2 | — |
ElevenLabs Inc. | Voice synthesis (optional) | USA | Tier 0 only | DPA + SCC |
AWS | Auxiliary services · European Sovereign Cloud (Tier 2 option) | EU (Ireland / Germany) | Tiers 0 · 1 · 2 | — |
'/%3e%3cuse%20xlink:href='%23a'%20transform='rotate(120%201203%201203)'/%3e%3cuse%20xlink:href='%23a'%20transform='rotate(180%201203%201203)'/%3e%3cuse%20xlink:href='%23a'%20transform='rotate(240%201203%201203)'/%3e%3cuse%20xlink:href='%23a'%20transform='rotate(300%201203%201203)'/%3e%3c/svg%3e){kind=small}
- •At the EU Resident and Private Cloud tiers, models are served through Azure OpenAI and Google Vertex AI: US vendors do not receive the data.
- •At the EU Resident and Private Cloud tiers, ElevenLabs voice synthesis is disabled or replaced with an EU alternative (e.g. Azure Speech, North Europe).
Technical measures
Privacy-by-design and privacy-by-default.
Organizational measures
People, processes, governance.
This content is a summary of the Technical Overview and does not replace the Data Processing Agreement (DPA) signed between the parties pursuant to Art. 28 GDPR.
Legal documents
Everything you need for your DPIA, your records of processing and your internal vendor assessment.
Got specific security requirements?
For regulated industries (finance, healthcare, public sector) we offer Private Cloud deployment. Let's talk.
Contact the Security team