Data, security, and the contract.

Updated October 2026

• Who is the contracting party?

  AgenVIO S.r.l., Via Enrico Cosenz 54, 20158 Milan, VAT IT14692990964, subject to the direction and coordination of Syncronika S.r.l. a socio unico. For processing questions: [email protected] and PEC [email protected].

• Where do agents, knowledge, and transcripts run?

  In the European Union. Text inference uses Mistral and open-weight models running in Italy and France. The catalog, including the default model, is on the Models page.

• Do our contents train the models?

  No. Conversations and the knowledge base are used to answer inside the service. We do not use them to train models.

• What reaches the model?

  The message, the conversation context needed for the reply, the passages retrieved from the knowledge base, and the agent instructions. Not the whole document archive.

• Can anything leave the European Union?

  Yes. Real-time voice and image generation today use best-in-class providers, with optional EU data residency: the European alternative is on the roadmap. Messaging, telephony, email, and hosting may use subprocessors that, depending on the setup, process data outside the European Economic Area. Standard Contractual Clauses apply in that case. The indicative list is in the Privacy Policy; the current list is available on request at [email protected].

• How are access and data protected?

  Encrypted traffic and encryption at rest, roles and permissions, API keys, and backups. Multi-factor authentication is available where the platform exposes it. Conversations with end users are visible to the customer's team: they are there for supervision and takeover.

• Does the AgenVIO team access the data?

  The company team uses the workspace and available configurations under its assigned access. AgenVIO support can assist with configuration and integrations within the support scope and applicable agreements. An automatic log of every technical access is not published: if you need that constraint, it belongs in the contract.

• Can a policy stop an action before it runs?

  Not yet. Today the constraint is the agent perimeter and the person who can step into the conversation. Automatic approvals are a product direction. The detail is on the Governance page.

• Do you have an ISO certification or a public penetration test?

  No. We do not publish a product certification or a downloadable test report. The measures described in the DPA are access control, encryption, backups, and incident handling. Reasonable audits are agreed with the customer.

• How quickly do you report a data breach?

  Without undue delay after we become aware of it, with the information available so the controller can assess notification to the authority within 72 hours. The wording is in the DPA. This page does not promise a tighter hourly deadline than the contract.

• What happens to the data when the contract ends?

  At the customer's choice, deletion or return of the data processed on their behalf, except where the law requires retention. How long conversations and transcripts are kept is decided by the customer, as controller.

• What is your role under the AI Act, and what is the SLA?

  The customer is the deployer of the systems configured on the platform and is responsible for the compliance of their own use. AgenVIO provides the platform: interfaces, APIs, and orchestration of models and channels. We do not publish an uptime percentage or a status page. Availability, backups, and recovery are agreed in the contract.