Data processing

Viti gives you the models you already trust, with all processing performed inside the European Union under EU-governed contracts, and with personal identifiers masked before a request leaves Viti's own infrastructure.

Every model provider is reached through an EU-processing route, and that is enforced in the platform, not just in policy: a provider that does not process in the EU cannot be added. First-party US and Chinese model endpoints are never used:

• OpenAI (api.openai.com) — US processing. GPT models are reached only through Azure OpenAI in the EU Data Zone.
• Anthropic (api.anthropic.com) — US processing. Claude models are reached only through AWS Bedrock in the EU.
• Moonshot (api.moonshot.cn) — processing in China. Kimi models are reached only through Azure AI Foundry, Data Zone EUR.
• DeepSeek (api.deepseek.com) — processing in China, and trains on submitted data by default. DeepSeek models are reached only through Azure AI Foundry, Data Zone EUR.

Several of our vendors are US-owned companies. We disclose that deliberately: corporate ownership and processing location are different things. Ownership is why the masking layer below exists; processing location is what the contracted EU routes guarantee.

Model inference is provided by Microsoft (Azure OpenAI, EU Data Zone), Amazon Web Services (Bedrock, Stockholm), Mistral AI (France) and Scaleway (Paris). Linkup (France, zero data retention) provides web search when a workspace enables it. Google Cloud (Vertex AI, EU regions) is a contingency route that is not in use. Hosting, identity and platform email run on Microsoft Azure in the EU, and invoices are issued through Visma e-conomic, Denmark.

None of the model routes is configured to retain prompts or completions for training. Scaleway may keep content for up to two weeks, only to investigate faults; it serves the sovereign tiers and takes over the default chat tier when its primary provider is unavailable.

Routing may fail over to another deployment of the same model, never to a different model family and never to a region outside the EU.

See the full list of subprocessors

Before any request leaves Viti's infrastructure for a model provider, it passes through an internal service that detects personal identifiers and replaces them with placeholders. The provider sees a placeholder where the user wrote the value, and the answer is restored inside Viti before it reaches the user.

• Detection is rule-based and deterministic, not done by a language model, so there is no second data flow to disclose.
• Masked: personal identification numbers (including Faroese and Danish CPR), IBANs, payment card numbers, email addresses and phone numbers. A workspace can narrow this list but not widen it.
• Not masked: names, places, organisations and street addresses. They are processed by the EU-processing providers under their DPAs. A customer that needs all content to stay under VITA's control can use the sovereign tier.
• The mapping from placeholder back to the real value exists only in memory for one request and is never written to disk or logs. Usage records keep only the count and type of what was detected.
• It fails closed: if a workspace has masking on and the masking service is unavailable, the request is refused rather than sent unprotected.

Images, scans and voice cannot be masked. Each workspace decides whether images are blocked, sent with a warning, or allowed; images that are sent are sent unmasked. New workspaces allow images; an administrator can block them. In the web app a user can black out parts of an image before sending; those areas are flattened in the browser, so the original never reaches Viti.

Masking is a strong mitigation, not a guarantee. Detection can miss personal data in unusual formats or where a person is identifiable from context. Do not treat it as licence to send special-category data (GDPR Art. 9) you would otherwise withhold.

Uploaded files are scanned for malware on upload. They are not scanned again on download.

No subprocessor processes personal data in the United States. Model inference and hosting are performed in the EU/EEA, and where a vendor is US-owned the contracting entity is European (Microsoft Ireland, AWS EMEA SARL, Google Cloud EMEA) with processing contractually confined to EU regions. Invoicing is contracted with a Danish company.

Limited access may still occur for support and administration, for example a vendor's engineers responding to an incident. That is covered by the EU Standard Contractual Clauses and the vendors' EU data boundary commitments. Should a US subprocessor ever be added, it would rest on the Standard Contractual Clauses and a documented transfer impact assessment, and be listed here first.

We give 30 days' notice before adding or replacing a subprocessor that processes customer content. You may object in writing during that period. Notice is sent by email to your workspace's administrative contact and by publishing an updated version of this page and the subprocessor list.

Data protection enquiries: info@vita.fo