How we stay out of your clients' data

Bertha runs on a machine in your office, and your clients' data stays there. We install and maintain that machine, so we have to say plainly when, if ever, we could see what is on it. The short answer: we arrange our work so that we do not need to, and when a problem cannot be solved any other way, only with your approval each time, in a session you start and can watch, and on a record you can read.

1. Our role

Your firm decides what happens to its clients' data; under the GDPR it is the controller. Because we maintain the machine that processes that data, Leyoda acts as your processor. Before anything is installed we sign a data processing agreement with you, which binds us to these rules and to the same confidentiality your firm owes its clients.

2. No access by default

• Nobody at Leyoda has standing access to the client data on your machine.
• We keep the machine healthy with technical signals that contain no client data: whether services are running, disk and memory use, software versions and error codes without their content.
• Updates are delivered as complete packages, and installing one does not require anyone to open your files. Verifying a digital signature on every update before it installs is being built in (section 6).
• No client data is ever sent to an outside AI service, to us or to anyone else.

3. When access is the only way

Sometimes a fault cannot be found without looking at the situation it happened in. Before anyone looks at client data, we first try every alternative: reproducing the problem with example data, reading logs with the content left out, or asking you to show us the problem with a test client. Only if none of these works do we ask for access, and then:

1. You approve each time, in writing. The request names the person, the problem, what they need to see and for how long. One approval covers one problem.
2. You open the door. Access happens only in a session you start, for a limited time, and you can watch it. It ends when the problem is found or the time is up.
3. As little as possible. We look only at what the problem needs: one client, one document, one step.
4. Nothing leaves the machine. No client data is copied, downloaded, photographed, or put into our tickets, chats or e-mails.
5. Every access is recorded. Who, when, why, for how long and what was seen, in a record on your machine that you can read, and in our own register.
6. Named people only. Only staff we have named to you, bound by confidentiality and trained in this policy, may ask.

4. If something goes wrong

If we learn of any incident affecting client data on your machine, we tell you without delay and in any case within 24 hours, with what we know and what we are doing about it, so you can meet your own obligations.

5. When our agreement ends

You receive a complete export of your data first. Then the machine's storage is wiped before it leaves your office or before we reuse any part of it, and you receive written confirmation.

6. Being built into the machine

These rules apply now, through how we work. We are also building them into Bertha's maintenance tools, so they are enforced by the machine rather than only by us: access that is impossible without a key you issue, updates that install only with a valid signature, logs that never contain client content, and the access record shown in Bertha itself. We will say on this page when each part is in place.

7. Questions and changes

Ask us anything about this policy at contact@leyoda.eu. We review it every year, and tell our clients 30 days before any change takes effect. See also our privacy policy.