Security and privacy
Everything your privacy, IT and works council teams need to sign off. Download the documents without signing up and share them internally.
At a glance
How Ordyse handles your data
Hosted in Germany
The platform and backups run with Hetzner Online GmbH in ISO/IEC 27001 certified data centers in Germany. If you prefer, you can run Ordyse in your own environment.
EU-based AI
The Mistral AI language model runs through its EU endpoint and is never trained on your data. Personal names in emails are masked. Ordyse can also run with no language model at all.
A person approves
Ordyse sends no external email and posts nothing to your ERP until an authorized person approves it, with four-eyes approval if you want it. Everything is in the audit log.
Processes, not people
Analyses run by process, customer and team, with at least five cases per group. Employees appear only under a pseudonym. There are no rankings and no per-person times.
Short retention periods
Ordyse deletes email bodies after 90 days and task mining sessions after 180 days. If you don't sign up for a plan, we delete all data no later than 60 days after the process assessment.
Your data stays yours
Export anytime in open formats (OCEL 2.0 and CSV), free of charge. Our terms cover switching providers in line with the EU Data Act.
Documents
Downloads
Templates as of October 22, 2026. The English versions are convenience translations; the German version prevails. They are not a substitute for legal advice on your specific case. You can adapt the Word versions to your organization.
For privacy, IT and works councils
We sign the data processing agreement before we access any data. We announce changes to subprocessors 30 days in advance.
- Data processing agreement (DPA)Under Art. 28 GDPR, ready to fill in and sign
- Technical and organizational measuresUnder Art. 32 GDPR: access, encryption, backup, deletion
- SubprocessorsWho processes which data, and where
- Sample works agreementEvaluate processes, not people. With an annex on task mining
- EU AI Act assessmentRisk class and your obligations as a deployer
- Data protection impact assessment templatePre-filled for your data protection officer
- Employee privacy noticeTemplate under Art. 13 GDPR