Last updated: 20 October 2026 · High-level, client-facing summary (Art. 32 GDPR). A detailed Security Assurance Plan (PAS) is maintained internally and will back this page once finalised.

Umamy implements technical and organisational measures appropriate to the risk (Art. 32 GDPR).

Hosting & data residency

• Core platform hosted in the EU: AWS Frankfurt (eu-central-1); application database Supabase Paris (eu-west-3); application backend Railway (EU West). Non-production environments are hosted in the EEA and Switzerland.
• AI inference via Microsoft Azure (resource in Sweden Central, EU). Migration to EU-only processing (Azure EU Data Zone) and removal of the remaining US AI provider are in progress.

Technical measures

• Encryption in transit: HTTPS/TLS across all endpoints.
• Encryption at rest: managed encryption on EU storage.
• Access control: role-based access control (RBAC), scoped access policies, centralised secrets management.
• Authentication: MFA-protected single sign-on for infrastructure access.
• Pseudonymisation: personal data is pseudonymised before being sent to certain AI providers.
• Logging & traceability: event and access logging; audit trail of changes to candidate and message records; agent conversations retained per conversation.
• Resilience: managed backups, including 35-day point-in-time recovery for core production data.

Organisational measures

• Data-subject requests handled via [email protected]; a do-not-contact list is enforced across all clients.
• Personal-data-breach management procedure (being formalised).
• Sub-processor register with a DPA and documented transfer safeguards per vendor (completion in progress).

In progress (roadmap)

• Formal breach detection & notification procedure and breach register.
• Retention automation (TTL) and cascade deletion.