Privacy & security

This page explains how Prudai protects your data and what you can do yourself to work safely. For the binding agreements, the Legal Center and the Trust Center are authoritative.

Official legal and trust resources

For contractual, privacy, and security/compliance information, refer to:

• Legal Center: legal.prudai.com
  • You can find official legal documentation and original PDFs:
    • NLdigital Terms 2025 (with the Prudai supplement)
    • Privacy Statement
    • Data Pro Statement (Data Processing Agreement)
    • Service Level Agreement (SLA)
    • Fair Use Policy
• Trust Center: trust.prudai.com
  • You can find security and compliance information, such as:
    • security commitments and overview
    • controls catalog (/controls)
    • certifications/compliance status
    • subprocessor overview
    • security/privacy FAQ (/faq)

Acceptance when you start a trial

When you start a trial, you tick one acceptance sentence in the checkout step. The checkout is in Dutch: “Door je proefperiode te starten ga je akkoord met onze Algemene Voorwaarden, de Fair Use Policy, de Verwerkersovereenkomst (Data Pro Statement), de Service Level Agreement en het Privacybeleid.” (By starting your trial you agree to our Terms and Conditions, the Fair Use Policy, the Data Processing Agreement (Data Pro Statement), the Service Level Agreement, and the Privacy Policy.) Each document in that sentence links to the Legal Center. Prudai records which version of each document was accepted and when.

Acceptance at your first sign-in

If you got an account on or after 7 September 2026, you accept the same five documents once in the app. If you are the owner of a new organization, you do so on behalf of the organization: you fill in the organization, your name and your email address, and declare that you are authorised to sign, or have been mandated by an authorised signatory. As any other new user you accept for yourself; that never counts as the organization’s acceptance. For each acceptance, Prudai records which version of each document was accepted, the sentence you ticked, when, from which IP address and with which browser, and for an acceptance on behalf of the organization also the organization, name and email address that were filled in. See Sign-in & persona selection.

How Prudai protects your data

• Sign-in required: the web app and the add-ins for Word, Excel, and Outlook are only reachable after signing in via login.prudai.com (single sign-on). Without signing in, people only see what your organization publishes itself or shares itself through a link or a service token, such as a Trust Center page in IRMA.
• Organization isolation: data is partitioned per organization. You can never see or search data from another organization, including via shared models or search features.
• Access only for active organizations: only organizations with a running subscription or an active trial get access. If the subscription has expired, the organization has been archived, or access has been blocked, nobody from that organization can reach the data any more in the web app, the IRMA app, ORDO, or the add-ins. Blocking access does not delete the data; retention and deletion after termination are governed by the Data Processing Agreement (see below). See Troubleshooting & support.
• Storage on our own servers in the EU: customer documents and case-file data are stored on Prudai’s own servers in EU data centers (Germany and Finland), not with a large cloud provider.
• AI processing: the language models run through Google Cloud Vertex AI and Microsoft Azure OpenAI; chat requests go to their EU endpoints. The providers do not use your questions, the answers or your documents to train AI models. They do not keep them permanently either: only a short-lived cache to speed up responses (minutes, at most 24 hours) and, if abuse is suspected, temporary retention for review by authorised staff of the provider.
• Encryption: connections are encrypted with TLS. On the servers, databases and search indexes live on fully encrypted disks.
• Subprocessors: which providers Prudai uses for hosting and AI processing, and in which region, is listed in the Trust Center.
• Certified: Prudai is certified to ISO/IEC 27001:2022 and NEN 7510-1:2024. The certificates (NL 3143.1.1 and NL 3144.1.1) were issued on 30 September 2026 by Brand Compliance, accredited by the Dutch Accreditation Council (RvA C 548), and are valid until 29 September 2029. More in the Trust Center.

Retention, logging, and Prudai staff access

For these three topics the contract documents are authoritative. We deliberately do not restate them here, so that documentation and contract cannot drift apart.

• Retention and deletion on termination: see the Data Pro Statement (Data Processing Agreement) in the Legal Center.
• Access by Prudai staff: see the Trust Center.
• Logging: see the Trust Center.

Basic safety rules

• Upload only documents you are allowed to handle (confidentiality, GDPR, professional secrecy).
• Add collaborators to a dossier or project deliberately: share with no more people than necessary.
• Do not paste real secrets into prompts (passwords, tokens, private keys).
• Review exported files (Word/PDF) before sharing.
• Do not include confidential case-file content in a support ticket; a description and the time are enough.

Roles and access

In your organization you have the role Owner or User (the Account Dashboard calls that role Member). An owner can perform administrative actions, such as managing organization prompts, setting an organization instruction, and creating an organizational knowledge base. There is also an Admin role for Prudai’s own administrators.

Roles operate within your organization; they never grant access to data outside your organization. The IRMA app has its own role management; see IRMA administration.

Knowledge settings are preferences, not permissions

On the Knowledge page you decide which sources and capabilities the assistant may use. Note:

• This is a preference, not an access right. What you switch off, the assistant does not use. Switching something on does not give you access to anything your organization or role is not entitled to.
• An owner can switch sources off for the whole organization. The assistant then uses them for nobody in your organization, even if you switch them on yourself.

See Knowledge (sign-in required).

Add-ins for Word, Excel, and Outlook

In the add-ins the app runs in a task pane, so sign-in happens in a separate, secure Office sign-in dialog. Be mindful of:

• your organization’s policies around add-ins,
• a maximum size when you send the text of a whole Word document.

More: Prudai For Word, Prudai for Excel, and Prudai for Outlook.