Security and confidentiality, explained plainly
Automating correspondence means access to confidential mail. Here is how we handle that: technically, contractually and organizationally.
Last updated:
Runs inside your network
The automation runs on a dedicated server in your network, sized for your volume. Emails, attachments and data from your IP management system are processed there, not on servers in Germany.
Local language model by default
By default, a local language model runs on that server. We only use a cloud model if you approve it for a specific purpose, such as translations, in a region you agree to and under a data processing agreement.
Confidentiality in the contract
Our standard contract includes confidentiality obligations and a data processing agreement under Art. 28 GDPR. For German firms, lumadata acts as a contributing person under Section 203(3) of the German Criminal Code; anyone we involve is bound to confidentiality in writing. When the contract ends, data is deleted or returned.
People sign off
You decide which steps run automatically and where a person signs off. Critical steps are only prepared, never completed on their own. Unclear cases go to your team with the reason, instead of being guessed.
Logged
Every automated action is logged and can be traced afterwards. Dashboards and alert rules show what is running and where something is stuck.
No training of third-party models
Your data is not used to train models of third-party providers. Improvements for your firm come from refining rules and matching based on your team’s corrections.
Maintenance coordinated with your IT
Operation and maintenance usually happen by remote access to the server in your network, coordinated with your IT and under the contractual confidentiality obligations.
Your configuration is yours
The workflows, rules and matching we build for your firm belong to you and are documented at handover. Language models are interchangeable; you are not tied to one model provider.
Architecture: everything inside your network
The automation runs on a dedicated server in your firm network, sized for your volume. The language model runs there, locally.
Local language model · workflows · monitoring
e.g. your docketing system
Frequently asked questions
Does client data leave the firm?
Not for processing, unless you approve a cloud model: the server and the language model sit in your network. For operation and maintenance we usually access that server remotely, coordinated with your IT and under the contractual confidentiality obligations.
How is confidentiality handled contractually?
Our standard contract includes written confidentiality obligations and a data processing agreement. For German firms, lumadata acts as a contributing person under Section 203(3) of the German Criminal Code, and anyone we involve is bound to confidentiality in writing.
Is there a data processing agreement?
Yes. The data processing agreement under Art. 28 GDPR is an annex to our standard contract. It describes the type and scope of processing and the deletion or return of data when the contract ends.
Is our data used to train AI models?
Not models of third-party providers. Improvements for your firm come from refining rules and matching based on your team’s corrections.
What happens when the contract ends?
Data is deleted or returned as set out in the data processing agreement. The configuration built for your firm belongs to you.
This page describes how we work. It is not legal advice.
Questions from your IT or privacy lead?
We are happy to answer them directly, together with your IT if you like. We can send you our standard contract, including the data processing agreement, in advance.
You talk directly to the founder.
Uhlandstr. 12
71729 Erdmannhausen
Germany