Security, compliance & data protection

Trust Center

One platform. Every AI model. Absolute data security — here is the evidence.

About DeepMask

DeepMask GmbH, headquartered in Munich, is a sovereign European AI workspace that unites 40+ leading AI models from OpenAI, Anthropic, Google, Mistral, DeepSeek and others in one GDPR-compliant interface. Switch models mid-conversation, compare outputs side by side, and choose the right tool for every task. No vendor lock-in. No context switching.

Every byte stays in Europe: by design, not by workaround. Primary hosting runs on STACKIT, the Schwarz Group's sovereign German cloud, with EU-region deployments for redundancy. User inputs and responses are never used to train AI models. Data is encrypted with TLS 1.3 in transit and AES-256 at rest. The platform and all stored content sit with a German provider, with data residency in Germany.

Trusted daily by law firms, patent attorneys, engineering offices, associations, and companies across the energy and financial sectors. Organisations where compliance is non-negotiable and data sovereignty is a hard requirement.

Your Trust Center contact

contact@deepmask.io

Questions on data protection, security and compliance

GDPR compliance

DeepMask is fully GDPR compliant. Data processing agreement under Art. 28, technical and organisational measures under Art. 32, an appointed external data protection officer and a record of processing activities under Art. 30.

Self-assessment DPA

ISO/IEC 27001

DeepMask GmbH operates a certified information security management system to ISO/IEC 27001:2022. The certification covers the design, development, operation and support of the platform. The certificate is valid until 26 August 2029 and is confirmed by annual surveillance audits.

Certificate (PDF)Documents

EU AI Act

The AI Act (Regulation (EU) 2024/1689) distinguishes between provider and deployer. DeepMask is the provider of the platform, you are the deployer within your own organisation — here is what each role entails and how we support you.

Roles & obligations

Hosting in Germany

The primary hosting partner is the Schwarz Group's sovereign German cloud (STACKIT) — certified to ISO 27001 and BSI C5. Beyond that, only EU regions are used, so your data never leaves European borders.

Subprocessors

Enterprise-grade encryption

TLS 1.3 for all connections, AES-256 for data at rest in databases, object storage and backups. Central key management with regular rotation and strict tenant separation per organisation.

Security measures

Never used for model training

Your inputs and the generated responses are not used to train AI models. This is contractually agreed with every model provider engaged and documented in the technical and organisational measures.

TOMs

Professional secrecy

DeepMask is built for every industry where data matters. For professions bound by statutory secrecy obligations, such as law firms, patent attorneys, tax advisors and medical practitioners, we go one step further: a dedicated confidentiality undertaking under Section 203 of the German Criminal Code (StGB), provided as an annex to our Data Processing Agreement.

Confidentiality

Resources