Data processing, documented.

01Roles

You are the data controller for personal data appearing in your knowledge sources and visitor conversations. Austial is the processor, acting only on your documented instructions — configuring the product is that instruction.

02Scope of processing

We process visitor messages, contact details captured with consent (lead forms), and personal data contained in sources you connect. Processing is limited to operating your chatbot, your analytics, and integrations you enable.

03Security measures

TLS 1.3 in transit, AES-256 at rest, workspace-level data isolation, role-based access, audit logging, and annual penetration testing. SOC 2 Type II certification is in progress; reports are shared under NDA once issued.

04Sub-processors

We use vetted sub-processors for hosting, email delivery, and payments, each bound by equivalent data-protection terms. We notify you 30 days before adding or replacing one, with the right to object.

05International transfers & deletion

Transfers outside the EEA rely on Standard Contractual Clauses. You choose EU or US hosting per workspace.

On termination, personal data is deleted within 30 days, with certification of deletion on request. Data-subject requests forwarded to us are answered within 72 hours.