Last updated: 27 September 2026
This page summarises how Sonian handles data under the GDPR. It is not legal advice. Your organisation should assess, with its own advisers, how the GDPR applies to its use of Sonian.
Who is responsible for what
Sonian is operated by Bruxon Tech BV (Asse, Belgium; enterprise number BE 1037.015.221).
| Data | Your organisation | Sonian |
|---|---|---|
| Documents you upload, playbooks, review results | Controller | Processor, acting only on your instructions |
| Your users' account and billing details | — | Controller |
| Website visits and access requests | — | Controller |
For our own processing as controller, see the privacy policy.
How we protect your documents
- EU storage. Documents, review results and account data are stored in the European Union.
- Encryption. Data is encrypted in transit (TLS) and at rest.
- Isolation. Each organisation's documents are kept separate from other organisations' documents.
- No training. We do not use your documents to train AI models. Our AI providers process content only to return a result and, under their API terms, do not train on it.
- Your control. You can delete documents at any time. When your account closes, you can export your content, and we then delete it from our active systems within 30 days.
Subprocessors
We use the following subprocessors to provide the service. We will update this list before adding a new subprocessor that processes your documents.
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Amazon Web Services | Hosting, database, document storage and processing | European Union | — |
| Qdrant Cloud | Search index for your documents | European Union | — |
| OpenAI | AI analysis of documents | United States | EU-US Data Privacy Framework / Standard Contractual Clauses |
| Cohere | Search ranking of document passages | United States / Canada | Standard Contractual Clauses / adequacy decision |
| Stripe | Payments and invoicing | United States / EU | EU-US Data Privacy Framework / Standard Contractual Clauses |
| Mailgun | Transactional email | United States | Standard Contractual Clauses |
| Sentry | Error monitoring | United States | EU-US Data Privacy Framework / Standard Contractual Clauses |
| Sign-in with Google; website analytics (with consent) | United States / EU | EU-US Data Privacy Framework / Standard Contractual Clauses | |
| GitHub | Sign-in with GitHub (optional) | United States | EU-US Data Privacy Framework / Standard Contractual Clauses |
Data Processing Agreement
Our Data Processing Agreement (DPA) sets out the terms under Article 28 GDPR on which we process your documents. It is available on request at info@sonian.ai.
Requests from individuals
If someone asks your organisation to access, correct or delete personal data contained in documents you uploaded, you can act on it directly in Sonian by editing or deleting the documents concerned. If you need our help, contact info@sonian.ai.
Security incidents
If we become aware of a personal data breach affecting your documents, we will notify your organisation without undue delay, with the information you need to meet your own notification obligations.
Contact
Bruxon Tech BV
Termolenhoflaan 62/4, 1731 Asse, Belgium
info@sonian.ai