01. Data Controller Information
The controller responsible for processing your personal data under the Swiss Federal Act on Data Protection (FADP / DSG) and Regulation (EU) 2016/679 (GDPR) is:
02. Core Privacy Principles
Our infrastructure architecture is built around three fundamental tenets:
- Privacy-by-Design & Default: Model runtimes, vector indexing pipelines, and log aggregators default to strict data minimization.
- Tenant Isolation: Every enterprise workspace runs in isolated cryptographically segregated memory spaces with dedicated encryption keys.
- Zero Foundational Training: Customer prompts, documents, weights, and inference responses are never utilized to train or fine-tune public foundation models.
03. Categories of Personal Data Processed
| Category | Data Elements | Purpose |
|---|---|---|
| Identity & Account | Name, corporate email, organization name, SSO/OIDC tokens, role assignment | Authentication, workspace administration, and billing |
| Platform Telemetry | API call timestamps, token counts, compute unit utilization, error traces, IP addresses | Service reliability, rate limiting, and DDoS mitigation |
| Inference Payloads | Vector embeddings, prompt context, structured inference output | Transient model execution in secure runtime fabric |
| Communications | Demo requests, support ticket history, security feedback | Customer support and enterprise account management |
04. Legal Bases for Processing
We process personal data only where permitted by statutory regulations (Art. 6 Swiss FADP / Art. 6(1) GDPR):
- Performance of Contract (Art. 6(1)(b) GDPR): Provision of cloud services, runtime routing, and enterprise technical support.
- Legitimate Interests (Art. 6(1)(f) GDPR): Network security, threat detection, performance benchmarking, and fraud prevention.
- Legal Obligations (Art. 6(1)(c) GDPR): Compliance with Swiss commercial accounting standards, tax laws, and export control regulations.
- Consent (Art. 6(1)(a) GDPR): Where explicitly requested for optional research evaluations or newsletter updates.
05. Zero-Retention Inference & Enclave Protection
When you send requests to the Studio 4711 Runtime Fabric:
- Payloads are processed exclusively in volatile memory (RAM) within confidential computing enclaves (AMD SEV-SNP / Intel TDX).
- Inference payloads are immediately purged from execution buffers upon response transmission.
- No customer prompt or output data is written to disk logs unless enterprise diagnostic tracing is explicitly toggled by the workspace administrator.
06. Data Sovereignty & Cross-Border Transfers
Our primary infrastructure is hosted in ISO 27001-certified Tier IV data centers located in Zurich (Switzerland) and Frankfurt (European Union). Switzerland enjoys recognized data adequacy status under European Commission Decision 2000/518/EC (reconfirmed in 2024).
Where data is transferred to affiliates or sub-processors outside Switzerland or the EEA, transfers are governed by standard contractual clauses (SCCs) and supplementary technical safety measures.
07. Authorized Sub-processors
We engage vetted sub-processors for infrastructure, telemetry storage, and security auditing under strict Data Processing Agreements (DPAs):
- Equinix Switzerland (Zurich): Physical colocation and confidential hardware hosting.
- Exoscale / A1 Digital (Geneva/Vienna): European sovereign cloud compute nodes.
- Postmark / Swisscom: Transactional system notifications and alerts.
08. Technical & Organizational Security (TOMs)
Studio 4711 maintains high enterprise security standards:
- Encryption in Transit: TLS 1.3 with Perfect Forward Secrecy across all public and internal interfaces.
- Encryption at Rest: AES-256-GCM hardware-accelerated encryption with customer-managed keys (CMK) support.
- Continuous Vulnerability Scanning: Automated static analysis, fuzzing, and third-party penetration testing.
- Access Governance: Hardware FIDO2 multi-factor authentication and just-in-time access approvals for operational staff.
09. Your Statutory Rights
Under the Swiss FADP and EU GDPR, you are entitled to the following rights at no cost:
- Right of Access (Art. 25 FADP / Art. 15 GDPR): Request confirmation and copies of personal data held about you.
- Right to Rectification (Art. 32 FADP / Art. 16 GDPR): Request correction of inaccurate personal data.
- Right to Erasure (Art. 17 GDPR): Request permanent deletion of data no longer required for its original purpose.
- Right to Data Portability (Art. 28 FADP / Art. 20 GDPR): Receive your data in a structured, commonly used, machine-readable format.
- Right to Lodge a Complaint: Lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Bern, Switzerland (edoeb.admin.ch) or your local EU supervisory authority.
11. Data Retention & Cryptographic Erasure
We retain account and administrative billing records for statutory retention periods prescribed under Swiss commercial law (ten years). Telemetry and runtime operational logs are automatically purged on a rolling 90-day retention schedule.
12. Contact the Data Protection Officer
To exercise your rights or submit questions regarding this Privacy Policy, please contact our Data Protection Officer: