# AI Governance Policy

## Overview

This document describes the technical processing of AI requests at Noveu: where the components run, which data is processed and which parties are involved.

## Principles

### 1. Where data is stored

- **Primary customer data (mail, files, identity) is stored in a Hetzner data centre in Falkenstein (Germany)**
- **Embeddings and vector storage run on our own infrastructure** in Falkenstein (BAAI `bge-m3` via self-hosted Text-Embeddings-Inference + pgvector)
- **LLM text generation**: since 29 August 2026, all AI functions have the text written by Mistral AI, a French company; according to Mistral, that data is stored in the EU by default. For the assistant, what goes to Mistral is your question, up to five earlier turns, the passages found with their source address and what the assistant looks up for you, such as emails, tickets and invoices; for the mail helper, the sender, subject and text of the email. Google Gemini (US) was phased out as an AI processor as of that date.
- Email addresses, phone numbers, IBANs, IP addresses, BSNs and web addresses in the text that start with http or https are replaced by placeholders beforehand

### RAG (Retrieval Augmented Generation)

```
┌──────────────┐     ┌──────────────┐     ┌────────────────────┐
│ User         │ ──► │ Query Engine │ ──► │ Vector Store       │
│ question     │     │ (EU-hosted)  │     │ (pgvector, on-prem │
│              │     │              │     │  EU; bge-m3 TEI)   │
└──────────────┘     └──────┬───────┘     └────────────────────┘
                            │
                            ▼
                  ┌─────────────────────┐
                  │ LLM (Mistral,       │
                  │  French company;    │
                  │  location: see the  │
                  │  table above)       │
                  │ + Retrieved Context │
                  └──────┬──────────────┘
                            │
                            ▼
                     ┌──────────────┐
                     │ Answer       │
                     │ with sources │
                     └──────────────┘
```

## Sources with an answer

In Questions (Vragen), the assistant shows the sources used with an answer.

## Parties in the chain

Cloudflare, Inc. (US) provides DNS, CDN, DDoS protection and TLS at the edge of the network. The other parties and their role are on [the public list of sub-processors](/en/legal/sub-processors).