EU data residency available
Organisations that need it can have their content hosted and stored in the European Union.
Security and data handling.
How DeepC keeps your research: where it is stored, who processes it, how accounts are secured, and what you can ask of us.
Where your data lives.
EU data residency is available, and the model providers that answer your questions keep none of your content.
Zero data retention
Third-party AI model providers use your content only to return a response. They retain none of it and train none of their models on it.
An isolated sandbox
Data analysis runs in an isolated sandbox, one per conversation, with no network access.
Your organisation only
Every conversation, document and file belongs to one organisation and is visible only within it.
Account security.
Every account carries a second factor, and every session is one you can see and end.
A second factor on every account
A passkey (Face ID, Touch ID or Windows Hello) or an authenticator app from the first sign-in, with ten one-time recovery codes. Organisations that require Microsoft sign-in rely on Entra’s own multi-factor policy.
Passkey sign-in
Sign in with a passkey alone, with no email or password to type.
Sessions you can see
Settings lists every signed-in device, with sign-out for one session or all the others, and a cap on concurrent sessions.
Lockout
Repeated failed sign-ins lock further attempts for progressively longer periods.
The audit trail and your data.
Every state change is recorded, and your data stays yours to export and to delete.
A seven-year audit trail
State changes are recorded and kept for seven years, among them every record number issued to a finished study from your organisation’s own sequence. Admins read the organisation’s log in the admin console, and each person reviews their own activity in Settings.
Permanent deletions
Deletions are permanent, and the audit record of each one is kept.
Download My Data
Exports an account’s data.
Account deletion
Removes an account’s data after an optional grace period and anonymises its audit trail.
The end of a contract
DeepCeutix deletes the organisation’s data within 30 days.
Your QP signs
Regulatory reports leave the Qualified Person sign-off to your QP.
Agreements.
Signed alongside your contract, for the regulations your organisation works under.
GDPR and UK GDPR
A data processing agreement is available on request.
HIPAA
A business associate agreement is available.
Sub-processors.
The third parties that process customer data on DeepCeutix’s behalf, with what each does and where.
| Sub-processor | Purpose | Region |
|---|---|---|
| Railway | Hosting for the platform’s services, database and object storage. | Netherlands (Amsterdam) for every service that handles customer data. |
| OpenRouter | AI model inference, restricted to zero data retention endpoints. | United States. |
| Microsoft (Azure AI Foundry, Azure OpenAI) | AI model inference for organisations on an Azure profile, and dictation. | Sweden Central. EU organisations are served within the EU data zone; organisations that choose global processing may be served from any Azure region. |
| Brave Search | Web search during a study. Receives the search queries only. | United States. |
| Cloudflare | Edge network in front of the platform, and encrypted transport. | Global edge network. |
| Cloudflare (Containers / Sandbox) | The isolated sandboxes where data analysis runs, destroyed after use. | Cloudflare’s EU jurisdiction. |
| Sentry | Error monitoring, with personal data redacted before it leaves the platform. | United States. |
| Resend | Transactional email. | United States. |
Last reviewed 29 September 2026.
Book a demo with a formulation lead.
From a first call to a pilot on your own programme.
01A demo
A call with a formulation lead, who is in touch within a business day.
02A pilot
On your own programme, scoped with your team.
The AI model providers behind DeepC retain none of your content and train nothing on it.
Prefer email? info@deepceutix.com