Security and Data Protection
Dedicated environments per customer, optional dedicated keys, and no training on your data.
Made & Hosted in Germany
At a Glance
What IT and data protection teams want to know first
Data path
Every request is routed encrypted through a protective layer into the customer's own environment. Mercury.ai is hosted as a SaaS on Amazon Web Services in Frankfurt.
Automatic scaling during peak loads
Changes will only go live after testing in DEV and TEST
Protective measures
Key management via AWS KMS and HSM, role and tenant separation, two-factor authentication, and user provisioning via SCIM. Mercury.ai hosts licensed Mistral models independently, sends no requests to external AI providers, and disables generative responses upon request in critical factual scenarios.
TLS 1.3 and AES-256
Single sign-on and SCIM
Complete audit log
Protection against Prompt Injection
Regular penetration tests
GDPR
Your company remains the data controller; Mercury.ai acts as a processor. This is governed by a data processing agreement pursuant to Art. 28 GDPR. You define the retention periods yourself—from immediately after input to the end of the contract.
Deletion is carried out in accordance with GDPR requirements, at the latest upon discontinuation of the project
Upon contract termination, export and deletion confirmation available upon request
AI Act
Mercury.ai is an AI system that integrates licensed models and does not provide its own General Purpose AI Model. The platform is not a high-risk system and does not make automated decisions concerning individuals in sensitive domains. The operator is responsible for the purpose and compliance of its specific deployment.
AI labeling pursuant to Art. 50, enabled by default in the chat widget
As an operator, you receive the AI Act documentation
Documentation
During the demo, we will showcase the platform and answer any questions from your IT and data privacy teams.