Security & data protection
What we see, what we do not, and where data is processed.
Our clients build software for regulated customers. This page sets out how we handle data in training and in ACI. Points still being confirmed are marked.
nDSG and GDPR
- Provider
- NodeonLabs s.r.o. is a company in Slovakia, in the European Union, and processes personal data under the EU General Data Protection Regulation (GDPR).
- Swiss clients
- Slovakia is on Switzerland's list of countries with adequate data protection under the revised Federal Act on Data Protection (nDSG), so personal data can be disclosed to a Slovak provider without additional safeguards.
- Processing agreements
- {{CONFIRM: data processing agreement offered to clients (GDPR Art. 28 / nDSG), and its template}}
In training and workshops
- Your machines, your tools
- Participants work on their own work laptops with access to the AI tools your company has approved. Each works on their own copy of a shared practice repository.
- Your code stays yours
- When we work on your repositories, we do so on your infrastructure and under your access rules. {{CONFIRM: wording on access to client repositories during engagements}}
- Sensitive data
- We agree with you what may be sent to which model. Where real data cannot be used, we work with anonymised data.
ACI: what it collects and where
- Customer-side Collector
- Raw activity is processed by a Collector in your infrastructure, a container with its own database. Only team totals, private suggestions for one person and each person's own view leave it.
- Team level only
- Team totals appear only for groups of five or more. There are no rankings and no individual views for team leads.
- What is collected
- Usage activity at the collection level you set, from team totals only up to activity with prompt analysis inside the Collector, plus which skills and agents are installed, by name and fingerprint. Session IDs are hashed; email addresses are not stored.
- What never leaves your environment
- Prompts, responses, code, diffs, file paths, shell arguments, tool input and output, and error text, at any collection level.
- Where it is processed
- Raw activity stays in the Collector on your side. Team totals are stored by augmented.club in a database in the EU (AWS, Ireland). {{CONFIRM: hosting region of the augmented.club application server}}
- Retention
- In the Collector, activity is kept 90 days (configurable from 30 to 365) and team totals 13 months. augmented.club keeps records 24 months; private suggestions expire after 30 days. A team's data can be deleted on request.
- Support access
- Only with an explicit grant from your administrator, for at most 24 hours, and logged.
- Works councils
- A privacy pack for your data protection officer and works council: data inventory, DPIA worksheet, employee notice and works-agreement clauses for each collection level. Draft templates for review by your counsel.
This website
This website sets no tracking cookies. Details are in the privacy policy.
Security questionnaire?
Send it to us and we will answer it, or bring it to a first conversation.