Home
GDPR & Data Protection

Data Protection

How AmpliFlow handles personal data

This page shows where customer data is hosted, which sub-processors we use, how breaches are handled, and how you request export or deletion. For binding terms, see the Privacy Policy.

Last updated: 2026-07-01

Data protection starts with operating choices

AmpliFlow's core service runs within the EU/EEA, collects limited data, and shows which sub-processors are used.

Each subscription can include a Data Processing Agreement. AI features are enabled separately, and the tenant administrator approves the selected provider before task-specific content is sent to that provider. That makes the data protection setup easier to review before the system is used.

Where data is hosted and when AI can send data onward

See the default operating locations for the app, files, website, logs, and analytics, plus optional AI flows that are only used after opt-in.

Hosting locations and optional AI flows

The core service runs within the EU/EEA. AI is enabled separately and the provider is actively selected.

Netherlands

Azure West Europe

Location: Netherlands
What is stored or processed: Application data and application hosting. All customer data encrypted with AES-256 at rest.
Protection and terms: AES-256 encryption, TLS 1.2+ in transit, role-based access control, multi-tenant isolation.

Finland

Hetzner Finland

Location: Finland
What is stored or processed: Website hosting, self-hosted Sentry (error monitoring), and application logs.
Protection and terms: Dedicated servers with disk encryption, TLS 1.2+ in transit. No customer data is stored here.

Sweden (Gävle/Sandviken)

Azure Sweden Central

Location: Sweden (Gävle/Sandviken)
What is stored or processed: Uploads and files from AmpliFlow. Document storage with Azure Blob Storage.
Protection and terms: AES-256 encryption at rest, TLS 1.2+ in transit. Files are stored in Sweden.

Germany (Frankfurt)

Hetzner Frankfurt

Location: Germany (Frankfurt)
What is stored or processed: Analytics database (Rybbit). No customer data is stored here.
Protection and terms: Dedicated servers with disk encryption, TLS 1.2+ in transit.

EEA data centres per provider DPA

Berget AI

Location: EEA data centres per provider DPA
What is stored or processed: Only data sent to the AI feature when the customer has enabled AI and selected Berget AI.
Protection and terms: Optional opt-in provider. Processing happens when the customer has enabled AI, approved Berget AI, and accepted the relevant DPA material.

United States or global infrastructure

US AI

Location: United States or global infrastructure
What is stored or processed: Only data sent to the AI feature when the customer has enabled AI and selected such a provider.
Protection and terms: Optional opt-in transfer outside the EU/EEA. Requires separate provider approval and applicable transfer safeguards.

EU countries

Operating location

Optional AI within the EU/EEA

Optional AI outside the EU/EEA

Map data © SimpleMaps.com

Protection in the service

These parts are included in how AmpliFlow handles personal data.

EU-Only Hosting

Customer data in the core service is stored on infrastructure within the EU/EEA. If you need a specific country or single data center, we review that before contract signing.

Operational Security

AES-256 encryption at rest, TLS 1.2+ in transit, role-based access control, and isolation between customers. Technical details are on the security page.

Data Subject Rights

Data subjects can request access, rectification, erasure, restriction, portability, and objection. Send requests to info@ampliflow.com, and we handle them within one month.

Sub-Processor Transparency

We show which sub-processors are used for the app and the website. AI is opt-in and requires separate tenant-admin approval for the selected provider. Berget AI and OpenAI can be selected only after the relevant approval and DPA/addendum review.

Breach Notification

We notify the customer contact within 24 hours when we discover a personal data breach. The notice covers what happened, which data may be affected, and which actions are being taken. The controller reports to the supervisory authority within 72 hours when GDPR requires it.

Export at Subscription End

When the subscription ends, you can receive a full data export for a small manual handling fee. Customer data is then deleted according to the agreement.

Our Sub-Processors

See which vendors process data, for what purpose, and in which area.

10 sub-processors, 9 EU-hosted, 4 optional (opt-in)

10 sub-processors shown

AmpliFlow App

Infrastructure

Microsoft Azure

Location

EU (Sweden & Netherlands)

Data processed

Application data, databases, files

Application hosting and file storage at data centers within the EU/EEA. No data leaves the EU/EEA.

Infrastructure

Hetzner

Location

EU (Finland & Germany)

Data processed

Application data and logs

Dedicated servers within the EU/EEA. No data leaves the EU/EEA.

Analytics

Pendo

Location

Data processed

Email addresses, user IDs, usage patterns

Shows how logged-in users navigate in AmpliFlow so we can improve the product. Tied to user accounts.

Communication

Mailgun

Location

Data processed

Email addresses, message content

Handles transactional emails like notifications and password resets through Mailgun's EU region.

Berget AI

Location

EEA data centres per provider DPA

Data processed

Context data relevant to the specific AI task

Swedish AI provider. Only used if the customer actively enables AI, approves Berget AI as an AI sub-processor, and selects Berget AI for AI features inside the application.

OpenAI

Location

United States or global infrastructure

Data processed

Context data relevant to the specific AI task

Only used if the customer actively enables AI, approves OpenAI as an AI sub-processor, and accepts the applicable DPA/addendum and transfer posture. OpenAI may involve processing outside the EU/EEA depending on approved project settings.

Mistral AI

Location

EU (France)

Data processed

Context data relevant to the specific AI task

French AI company. Can be evaluated separately for customers who want AI features with EU-based processing. Requires a separate contract in addition to the standard subscription. Contact us to discuss current provider documentation.

Self-hosted LLM

Location

EU (datacenter of choice)

Data processed

Context data relevant to the specific AI task

AmpliFlow can host an open model (e.g. Qwen) on dedicated infrastructure within the EU/EEA. Data is processed within the agreed EU/EEA environment and the model runs isolated for your organization. Requires a separate contract and an additional monthly infrastructure cost. Contact us to discuss your options.

Marketing website (ampliflow.se / ampliflow.com)

Analytics

Rybbit

Location

EU (Self-hosted)

Data processed

Anonymous visitor statistics (page views, navigation, campaign parameters), no personal data

Self-hosted instance of Rybbit, open source, running on our own servers. Collects anonymous visitor statistics (page views, navigation, outbound clicks, campaign parameters such as UTM tags, and JavaScript errors) without cookies and without personal data.

Communication

MailerLite

Location

EU (Lithuania)

Data processed

Email addresses of newsletter subscribers

Lithuanian company that handles newsletter delivery to subscribers who have actively opted in.

Data Processing Agreement

When your organization uses AmpliFlow, you are the data controller. You decide what personal data enters the system and why. AmpliFlow (operated by Cognit Consulting AB) is the data processor. We process that data on your behalf, strictly according to your instructions and GDPR requirements.

A Data Processing Agreement (DPA) defines each party's responsibilities: what data is processed, how it is protected, and what happens if something goes wrong. AmpliFlow provides a DPA as part of every subscription agreement. No add-on, no extra cost.

In practice, this means your organization stays in control. We handle your data according to the rules you and GDPR set.

Need a DPA? Contact us and we will send the right document.

AI providers as sub-processors

AI providers are not part of the default AmpliFlow core service. They are used only when a tenant administrator enables AI and approves the selected provider inside the application. The approval records the current AmpliFlow Terms, Privacy Policy, approval text, and provider-specific facts shown at the time of approval.

For GDPR roles, the customer remains the controller for customer content. Cognit Consulting AB acts as processor for AmpliFlow, and the approved AI provider acts as an AI sub-processor for the limited purpose of receiving AI requests and returning AI-generated answers.

Berget AI: Berget publishes a DPA at https://berget.ai/en/dpa (last updated 2026-04-08). We describe it as EEA data-centre processing based on that provider documentation, not as a guarantee that all processing is limited to Sweden.
OpenAI: OpenAI publishes a data processing addendum at https://openai.com/policies/data-processing-addendum/ and a sub-processor list at https://openai.com/policies/sub-processor-list/. OpenAI should be approved only when the customer accepts the applicable transfer, residency, retention, and subprocessor posture for the configured project.

We avoid unsupported blanket claims such as "EU-only AI" or "zero retention" unless the exact provider and project control is documented and approved.

Core service processing stays in the EU/EEA

AmpliFlow's core service processes customer data within the EU/EEA. This reduces the need for supplementary safeguards for third-country transfers in normal operation.

Microsoft Azure, our infrastructure provider, is certified under the EU-U.S. Data Privacy Framework (DPF). All data centres we use are located within the EU.

Exception: If you explicitly choose to enable AI features, the selected provider may process task-specific AI request data outside the EU/EEA. See our Privacy Policy, Terms of Service, and provider documents for details.

Export when the subscription ends

At the end of your subscription, we can export your data in machine-readable format plus original files, such as attachments you have uploaded. Customer data is then deleted from our systems according to the agreement.

We charge a fee for the export as the process still requires some manual handling. We're actively working to automate this and continuously reduce the cost.

Quick check of common GDPR questions

Answer 7 questions about hosting, DPA, breaches, export, and data subject rights.

7 questions. About 2 minutes.

Frequently Asked Questions

What personal data does AmpliFlow process?

Names, email addresses, and usage data as described in our Privacy Policy. The specific categories depend on how your organization uses the service.

Where is my data stored?

Within the EU/EEA for AmpliFlow core service data. We use infrastructure partners including Microsoft Azure and Hetzner with data centers in Sweden, the Netherlands, Germany, and Finland. AI features are opt-in and require separate approval inside the application. Approved AI providers may process task-specific AI request data in the locations described for that provider.

Can we require data to be stored in a specific country or datacenter?

Yes, that is something we can discuss. We are expanding data residency options, from consolidated EU hosting today toward single-datacenter deployments in any EU/EEA country for customers with those requirements. Get in touch and we will walk you through what is possible for your organization.

How do I exercise my data subject rights?

Email info@ampliflow.com with your request. We respond within one month, as required by GDPR.

What happens to my data when I cancel?

Full data export is available for a small fee so you can retrieve your information. After export, customer data is deleted from our systems. Timelines and format are covered in the Terms of Service.

Is a DPA included?

Yes. AmpliFlow provides a Data Processing Agreement on request. It defines responsibilities, data categories, security measures, and breach notification procedures. Email security@ampliflow.com to request one.

Do you transfer data outside the EU?

AmpliFlow core service data is stored within the EU/EEA. AI features are entirely opt-in and are enabled inside the application. Berget AI is documented by its DPA as EEA data-centre processing. OpenAI should be chosen only when your organization accepts the applicable OpenAI transfer, residency, retention, and subprocessor terms.

Does the website collect data?

This website (ampliflow.se / ampliflow.com) uses Rybbit, a self-hosted, open-source analytics platform running on our own servers. It collects anonymous visitor statistics without cookies and without personal data: page views, navigation, outbound link clicks, campaign parameters, and JavaScript errors. No analytics data leaves our servers.

Questions About Data Protection?

If you have questions about how AmpliFlow handles personal data, need a DPA, or want to exercise your data subject rights, contact us.

Email: info@ampliflow.com

Visit our contact page →