Security
Agreements and responsibilities
Who is responsible for the data the quote request app handles, what we agree in writing before the app is taken into use, and what happens when the cooperation ends.
Who is responsible for what
- Your company
- The controller. You decide which mailboxes and data the app handles and who uses it. The data stays in your company's own Microsoft environment the whole time.
- Microsoft
- Your company's own provider, under your company's own Microsoft agreement. Microsoft's usage fees are billed to you directly, and Thousandhouse is not in between.
- Thousandhouse
- Delivers and maintains the app. We process your company's personal data only in the test material for the setup, in support requests and in problem reports your users send, and then we act as a processor.
Data processing agreement
We sign a data processing agreement before we receive any of your company's material. It sets out which data we process and why, how it is protected, which subprocessors we use and when the data is deleted. The agreement follows Article 28 of the GDPR.
Confidentiality
Your customers' drawings, lists and prices are confidential. Confidentiality is part of the data processing agreement, and if needed we sign a separate non-disclosure agreement before you show us any of your own material.
Data and settings
Your company's data, settings and requirements belong to your company. They are kept in your own environment, and you can take them with you.
Where the data is
The data is stored in your company's Microsoft environment in the EU region, and the language model runs in the EU. Retention periods are agreed during the setup, following your company's policy.
AI and EU rules
The app makes no decisions about people, so it is not a high-risk system under the EU AI Act. The language model reads and drafts, and a person checks and sends every email, inquiry and offer. The app shows for each case what the model received and what it answered, and during the setup we go through with your users what the model does and what it doesn't.
When the cooperation ends
Your administrator removes the app and its permissions. The data is in your own Microsoft environment, so you can keep it before removal. Thousandhouse deletes any of your material it holds, such as test material and problem reports, as set out in the data processing agreement.
Want to read the agreements first?
We'll send the data processing agreement and the non-disclosure agreement for you to read before a demo or a decision.
Ask for the agreements