This page summarises how Random Solutions s.r.o. protects data processed in Random Assistant: sub-processors, security measures, the Data Processing Agreement, incident response and certifications. It is for information. The binding terms are in the Terms of Service and the Data Processing Agreement, and they prevail where this page differs.
1. Sub-processors
The third parties Random Assistant routes Customer Data to in order to deliver the service. We notify subscribers at least 30 days before adding or replacing an entry (§5). The AI model providers reached through OpenRouter, with entity, location and transfer basis, are in DPA Annex III.
Email and calendar connection for Google and Microsoft accounts
Where
EU (Ireland); backups may be stored in the United States, Canada, Australia and Brazil
Transfer basis
None needed for the EU region (Ireland). Backups and support access outside the EU: EU SCCs (Module 3) in the signed Nylas DPA; Nylas is also certified under the EU-US Data Privacy Framework; Canada has an adequacy decision
AI model routing for chat, background tasks and dictation; keeps request metadata, not content. The model providers behind it are listed in DPA Annex III.
Where
EU data regions only: EU endpoint (eu.openrouter.ai) and our account guardrail allow EU data regions only; if no EU route is available, the request fails. OpenRouter, Inc. is a US company; account, billing and sign-in data and security logs may be processed in the United States under the EU SCCs
Transfer basis
EU SCCs in the OpenRouter DPA (Terms of Service §10.2)
Live text while you dictate, where switched on (api.eu.mistral.ai). Mistral AI keeps that audio and text for up to 30 days for abuse monitoring and never uses them for training.
Where
EU (France); some of Mistral's own sub-processors may process data outside the EEA
Transfer basis
EU SCCs for Mistral's own sub-processors outside the EEA; none needed for the EU endpoint
Error monitoring; reports carry no request bodies, cookies or user details, and email addresses, tokens and long numbers in error text are masked before a report is sent
Where
EU (Germany)
Transfer basis
EU SCCs in the Sentry DPA for access by Sentry, Inc. (US)
Web search, where web research is on; only the query and a market code are sent
Where
EU (France). Only where Web research is on (off until you turn it on); when Staan's EU index lacks results, Staan may pass the query to its own search providers in the United States.
Transfer basis
None needed (EU). For the US fallback: your opt-in when you turn Web research on, after the notice shown on the switch (Art. 49(1)(a) GDPR).
Messages to or mentioning the Random bot, and commitments in the channels you switch on; Random posts approval cards (including a follow-up draft's text and recipient) into your direct messages with the bot, answers your /random commands privately (meetings, follow-ups, contacts) and adds status reactions; and sends the reminders and workflow notifications you set up as direct messages from the bot
Where
US (Salesforce / Slack; EU data residency available)
Read your store's products, orders, revenue and customer aggregates, and create or update discounts and products only after you approve each change. Connected with a custom app you create and install in your own Shopify store. Customer names, emails, phone numbers and street addresses are dropped on read and never stored.
Where
Global (Shopify infrastructure; no EU-only data residency offered)
Kickscale sends each analysed meeting to a webhook address unique to your workspace; Random keeps the transcript, encrypted, so you can read it in Meetings. We do not call Kickscale.
AES-256-GCM on every Class A field (email bodies, transcripts, prep packets, briefs, OAuth tokens). Per-tenant keys derived via HKDF-SHA256 from a deployment master key held outside the database, so a database snapshot alone cannot decrypt any tenant's content.
In transit
TLS 1.2 or higher on every endpoint, including the dashboard, the API, the deletion endpoints, and outbound calls to sub-processors. HSTS and modern cipher suites enforced at the edge.
Model region
Every account is served in the EU. AI requests go through OpenRouter (a US company) on its EU endpoint (eu.openrouter.ai), limited to EU data regions and to providers that do not collect your data or train on it. If that route is unavailable, the request fails; it never falls back to the US. We make no claim that any provider is beyond non-EU legal process.
Mailbox & calendar residency
Nylas brokers mailbox and calendar access and processes it in its EU region, Ireland. Backups and access by its support engineers in the United States and Canada are outside the EU, under the Standard Contractual Clauses (Module 3) in the Nylas DPA, signed on 2 October 2026; Nylas is also certified under the EU-US Data Privacy Framework.
Voice & audio
Dictation audio is transcribed in the EU by a Mistral AI speech model (France, EU) through OpenRouter's EU endpoint, and directly on Mistral's EU endpoint for the live text where switched on. Audio is never sent where the workspace's data policy disables it. Random Assistant does not join or record customers' meetings; it works from the transcript the workspace's own notetaker produces. We use a meeting recorder for our own internal meetings only; it is not offered to customers.
Authentication
Sign-in uses HttpOnly, Secure session cookies; a session lasts 24 hours by default. Every request that changes data is protected against cross-site request forgery. Values used to connect an account are single-use and expire.
Tenant isolation
Each workspace's data is kept separate in every database query. The application connects to the database as a restricted role, and row-level security policies keyed to the workspace are enabled in the database.
Secrets
Credentials and keys are kept out of source code, stored on the server with access limited to authorised administrators, and code changes are checked automatically for accidentally included secrets before they are merged.
Rate limiting
Sign-in, deletion and other abuse-prone endpoints are rate-limited per IP address and per account. Privileged actions are recorded in an audit log kept for 12 months.
Backups
Nightly database backups, deleted on a rolling basis within about 30 days. Content encrypted in the database stays encrypted in the backups.
3. Data Processing Agreement
Random Assistant's GDPR Article 28 DPA is accepted together with the Terms by every customer. It covers documented instructions, confidentiality obligations on personnel, Article 32 security measures, sub-processor authorisation, international transfer mechanisms (the EU-US Data Privacy Framework where the recipient is certified, otherwise the Standard Contractual Clauses, Module 3), a no-training clause, Article 33 breach notification, audit cooperation, and service-provider terms for customers to whom the CCPA applies.
The DPA on our website is the only version: it is concluded when you accept the Terms, and we do not sign separate or negotiated copies. Its effective date is printed at the top, so a saved copy of the page is your record.
4. Incident response and breach notification
We handle security incidents under a documented incident-response procedure. Our commitments to customers are:
Detection. Error tracking and scheduled-job health checks alert us continuously, sign-in endpoints are rate-limited, and integration-credential errors are logged and surfaced. Report a suspected incident (e.g. "I think I'm seeing another tenant's data") to security@random-assistant.com; we acknowledge it within one business day, and sooner wherever we can.
Containment. We first contain the incident, for example by revoking compromised credentials, rotating keys, isolating affected systems and disabling affected integrations.
Evidence preservation. Snapshots of database state, application logs, system journals, and access logs are taken before remediation begins so the forensic record is preserved.
Notification timeline. Where personal data in your workspace is affected, we notify you (the controller) within 48 hours of becoming aware, or 24 hours for confirmed exfiltration, as the DPA sets out, so you can meet your own 72-hour duty under GDPR Article 33; we then supplement the notice as facts emerge. For data we control (your account, this website), we notify the competent supervisory authority within 72 hours (Article 33) and affected people without undue delay where the risk is high (Article 34).
Post-incident report. After an incident is closed, affected customers receive a written summary of its cause and the measures taken.
Before any new sub-processor begins processing Customer Data, we follow a fixed sequence:
We email the account owner and the privacy contact on file at least 30 days before a new sub-processor starts processing Customer Data.
A customer may object within those 30 days on reasonable data-protection grounds, by replying to the notification email or writing to privacy@random-assistant.com.
If the objection is not resolved within 15 days, the customer may terminate the affected service without penalty and receive a pro-rata refund of prepaid fees (Data Processing Agreement, Section 8).
The /legal/processors registry is updated and its last_updated date changes.
Customers who maintain procurement systems that poll for sub-processor changes can subscribe to the JSON view at /legal/processors.json; the last_updated field bumps whenever any entry changes.
6. Certifications and assurance
Random Solutions s.r.o. does not currently hold a third-party security certification or attestation, such as ISO/IEC 27001 certification or a SOC 2 report. The security measures we apply are set out in Annex II of the Data Processing Agreement and summarised in Section 2. Customers can check them through the information and audit rights in Section 13 of the Data Processing Agreement, including written answers to security questionnaires.
Data protection. We process personal data in accordance with the GDPR. For customer workspaces we act as processor under an Article 28 Data Processing Agreement. Customer data is stored in the EU, our sub-processors are listed publicly, data subjects can exercise their rights as described in the Privacy Policy, and personal-data breaches are notified as described in Section 4.
Health data. The Service is not intended for protected health information within the meaning of HIPAA, and we do not offer a Business Associate Agreement. Customers must not use the Service to process such information.
We answer reasonable security questionnaires (for example CAIQ or SIG Lite) in writing. Send them to privacy@random-assistant.com.
7. Infrastructure jurisdiction (Data Act Art. 28)
Information under Article 28 of Regulation (EU) 2023/2854 (Data Act). It forms part of our Terms of Service.
Application and database
Germany: Hetzner Online GmbH, Falkenstein.
Document services
Finland: Hetzner Online GmbH, Helsinki (self-hosted e-signature and object storage).
CDN and web firewall
Cloudflare, Inc. (US company), global edge network; requests may be handled at edge locations outside the EU.
Mail and calendar access
Nylas, Inc. (US company), EU region in Ireland; US and Canadian support engineers may access error logs for a support ticket; backups may be stored in the United States, Canada, Australia or Brazil.
Email delivery
AhaSend B.V. (Netherlands, EU), servers in the EEA: account and notification email, which can include text from a workflow.
Speech to text
Dictation: Mistral AI (France, EU), through OpenRouter's EU endpoint, and directly on Mistral's EU endpoint for the live text where switched on. We do not transcribe customers' meetings; your own meeting tool does.
AI inference
Every account: OpenRouter, Inc. (US company) through its EU endpoint, with every request limited to EU data centres; if that route is unavailable, the request fails. The live list is at /legal/processors.
Safeguards against third-country government access
Sensitive workspace content (email bodies, transcripts, briefs, OAuth tokens) is encrypted at rest with per-tenant keys derived from a master key we hold in the EU. We disclose data to a public authority only under a binding order recognised under EU or Czech law or an international agreement (Data Act Art. 32), we disclose only the minimum the order requires, and we tell the affected customer first where the law allows.