No behavioural tracking
The audit log records what changed on a record — with the old and the new value. It deliberately does not record who looked at or clicked on what. A log that captures every glance is a surveillance tool, not an evidence tool.
Data sovereignty
We can name every place
We can name every place
your data sits.
Not “in the EU”. Not “with certified partners”. But: these three data centres, 740 kilometres apart — each with provider, region and purpose. Hover over a dot.
Sub-processors
The list nobody else shows you.
Article 28 GDPR gives you the right to know it. Here you don't have to ask — it is on this page, with a 60-day objection window for every addition.
| Provider | What for | Which data | Region |
|---|---|---|---|
| Hetzner Online GmbH | Hosting, database, object storage, backups | all customer data at rest | DE Falkenstein · Nuremberg |
| Scaleway SAS | Transactional email — invitations, reminders, workflow mail | email address, subject, body | FR Paris |
| Mistral AI SAS | AI features — summaries, drafts, enrichment | the text passed in and the response | FR Paris |
| Cloudflare Germany GmbH | DNS, CDN, protection against attacks | domain metadata, request logs | EU European edges |
| Sentry GmbH | Error tracking | technical stack traces — personal data switched off | EU |
| DocuSign on request only | E-signature in the contracts module | contract PDF, recipient addresses, audit trail | EU data region, US parent |
| Anthropic on request only | AI features, if you explicitly enable them | the text passed in and the response | US only with a signed addendum |
The last two rows are inactive for every tenant until they order them and sign the matching addendum. There is no switch that turns them on by accident — the release is tied to a contract document, not to a setting.
Design decisions
Four things AGC Suite does not do.
Data protection shows less in what a system stores than in what it deliberately leaves alone.
No external fonts
Every typeface sits on our own server — including the four pairings you can pick for your own theme. No connection to Google Fonts, not from the application and not from this website. The 2022 Munich ruling showed what such a connection is worth.
No rewriting of links
What an email from AGC Suite says is where the link goes. No click counter in between, no foreign intermediate domain. That is not a setting anyone could forget — the delivery path is chosen so that links cannot technically be rewritten.
No retention just in case
Commercial records, security-relevant events and ordinary changes are kept for different periods rather than all alike. Keeping data too long is not the safe option under data protection law — it is a failing in its own right.
Artificial intelligence
If no EU provider can do it, the suite says so.
AI features run through a French provider by default. If your tenant is restricted to EU providers — the default setting — and no suitable EU provider is available for a given task, the suite honestly reports the feature as unavailable.
It never quietly reroutes the request to a provider outside the EU.
That is the actual point. An “EU only” switch that sends data elsewhere when in doubt is worse than none at all: it creates an assurance someone will rely on. A provider outside the EU only becomes reachable once you have signed a separate addendum and the tenant is explicitly enabled for it — both recorded with a timestamp and a reference to the document.
Data subject rights
Built in, not bolted on.
-
Art. 15
Access
Every record carries a history with timestamp, person and the fields affected, including the old and new value. Tenant administrators additionally see every support session in which we as the provider accessed their tenant — without having to ask for it.
-
Art. 17
Erasure
When an account is deleted, the profile photo, name and job title go with the rest of that person's data. Cold leads that never converted are anonymised automatically after a period you set — active customers never are.
-
Art. 21
Objection
Every automated email carries an unsubscribe link, and every contact has a consent status per purpose with a provable history. If someone objects, every later workflow skips them automatically — and for leads the objection survives conversion into a contact.
-
Art. 28
Processing on your behalf
You are the controller, we are the processor. You set the retention periods, not us. New sub-processors are announced in writing, with 60 days to object.
Ask us the uncomfortable questions.
Where exactly does the backup sit? What happens when an authority comes asking? Who on your side can access our tenant, and is that logged? We have an answer to each of those that you can verify.