Vigil and GDPR, in plain language

Vigil is built by a company in the Netherlands, so GDPR isn't something we bolt on for EU customers. It's the law we operate under. This page explains how it applies to Vigil, in plain words. The legal version is the Privacy Policy and the Data Processing Addendum; this post says the same things shorter.

Who is responsible for what#

GDPR has two main roles.

• —You are the controller of the data in your AI calls. You decide what your app sends and why.
• —Vigil is your processor for that call data. We process it only to give you the service: measuring, monitoring and optimising your AI calls.

For your account data (your email, name and billing), Vigil is the controller.

Vigil is operated by Evolmet B.V., The Hague, the Netherlands. Our supervisory authority is the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

The data processing agreement (DPA)#

If you use Vigil for business, GDPR requires a DPA between us. Ours sets out what we process, why, for how long, who helps us, and how we protect it. It is public at vigil.tools/dpa, it forms part of the Terms of Service, and it applies to every account automatically: there is nothing to sign. If your procurement process needs a signed copy, email us and we will sign one.

Why we process data (lawful basis)#

Where the data lives, and who helps us#

Our main database is in Frankfurt, Germany (EU). These companies help us run Vigil (our "subprocessors"):

This table is the same list as section 6 of the DPA, and the subprocessor page adds each company's legal entity, what it receives and links to its own terms.

The honest part: US companies#

Several of our subprocessors are US companies. Our stored data sits in the EU, but a US company can, in some cases, be required by US law to hand over data it controls, even data stored in Europe.

Where personal data goes to, or can be accessed from, outside the EU, GDPR requires a transfer mechanism, and ours is per company. Cloudflare, Vercel, Resend, Stripe and PostHog are listed in the EU-U.S. Data Privacy Framework and also carry the European Commission's Standard Contractual Clauses in their data processing terms. GitHub and Google state that they comply with the Framework. Supabase, a Singapore company, and Reddit, which is not in the Framework, rest on the Standard Contractual Clauses alone. Plausible is an EU company and makes no transfer.

Hosted Vigil is not an EU-only service, and we won't pretend it is. If your organisation needs every part of the path to stay in the EU, talk to us before you connect.

How we protect it#

• —Prompts and responses are never stored, so the most sensitive data is never at rest with us. What Vigil stores has the full list.
• —All traffic is encrypted in transit (HTTPS/TLS); the proxy refuses plain HTTP.
• —Each account's data is separated from every other account's by row-level security in the database, keyed to your account id.
• —Vigil API keys are stored as one-way digests and can be revoked from the dashboard at any time.
• —Access to production systems is limited to the people who run Vigil.

Your rights#

Under GDPR you can ask us to:

• —give you a copy of your personal data
• —correct it
• —delete it
• —send it to you in a portable format
• —stop processing it for a given purpose, or object to it

Two of these are buttons: Settings exports everything we hold against your account as one JSON file, and Settings deletes the account. For the rest, email info@vigil.tools. We answer within one month.

If you're our customer's end user, your request goes to that customer first: they are the controller, and we help them answer it.

If something goes wrong#

If a data breach affects you, we tell you without undue delay; the DPA commits us to 48 hours for our customers. Where GDPR requires it, we report it to the Autoriteit Persoonsgegevens within 72 hours.

What we ask of you#

• —Don't put personal data in agent labels. Use names like invoice-parser.
• —Add Vigil to your own records of processing and your subprocessor list.
• —Read the DPA once. It already applies to you; it helps to know what it says.

FAQ#

Is Vigil GDPR compliant?

Vigil is built and run to meet GDPR. It is operated by a Dutch company, never stores prompts or responses, keeps its database in the EU, and its DPA applies to every account. GDPR certification schemes exist under Article 42, but they are rare and scheme-specific; Vigil holds none, so we say "built to meet GDPR" and not "GDPR certified".

Is Vigil a processor or a controller?

A processor for your AI call data, and a controller for your account data.

Where is Vigil's data stored?

In Frankfurt, Germany (EU). Some subprocessors are US companies; see the table above.

Is Vigil EU-only?

No. The stored data is in the EU, but some providers in the path are US companies.

Who do I contact about privacy?

Email info@vigil.tools. It reaches the people who run Vigil, not a ticket queue.