Skip to content
Menu

Where your data goes, and who is responsible for it

Your AI agent works on your quotes, your invoices and your emails. You need to know where this data is read, what comes out and who is responsible. Here are our choices, with the limits we do not hide.

Where your agents run: three set-up options, you decide

The path of your data, from your tools to the agent, to the AI model and on to KenduLe trajet des données. Vos outils envoient ce qu'ils reçoivent à l'agent IA, installé là où vous le choisissez : dans votre compte cloud en région UE, sur vos propres serveurs, ou sur un serveur dédié chez nous en Europe. L'agent envoie un extrait au modèle d'IA, qui peut être appelé chez un fournisseur. Ce qui remonte jusqu'à Kendu Intelligence : seulement des indicateurs et des alertes, des chiffres. Your toolsemail, invoicing, files Wherever you chooseAI agentprepares, you approve an extract figures AI modelmay be calledat a provider Kendu Intelligenceindicators and alerts:figures only

Choose a location: the path updates. In every case, what reaches Kendu Intelligence is indicators and alerts. The AI model may be called at a provider: see where your texts are read.

In short: your agents are installed where you choose: in your own account with a major provider, in the European Union; on your servers; or on a dedicated server with us, in Europe.

An AI agent is a small program. It prepares a piece of work (a payment reminder, a draft reply, a quote) and submits it to your team. You choose where it is installed.

  • In your cloud account, in an EU region. The cloud is servers rented from a major provider. A “region” is the physical location of its data centres. Your agents run in your own account, in a region of the European Union. You keep control of access and of the bill.
  • On your own servers. For companies that already have a server room or a regular hosting provider. Nothing leaves your network without your agreement. One exception: calls to the AI model (the engine that reads and writes, see below), if it is not installed on your side.
  • On a dedicated server with us, in Europe. A server reserved for you alone, which we administer. The hosting provider is stated in your quote. It is the simplest choice without an IT team.

For example, an SME of 40 employees with no IT department could choose the dedicated server. We discuss it from the audit onwards, depending on your tools, your constraints and your budget.

What reaches us: indicators, alerts and tickets

In short: our monitoring tool will receive only indicators and alerts; a ticket will contain the technical detail of a problem. Your emails, invoices and files stay where your agents run, except the extracts read by the AI model.

  • the number of actions proposed, then approved, corrected or refused by your team;
  • response times, errors and time saved, agent by agent;
  • the consumption of the AI model, counted in “tokens” (the units of text that the provider charges for);
  • alerts: an agent that stops, a repeated error, a change of AI model.

Key facts

  • 3set-up locations to choose from
  • 4autonomy levels, from 0 to 3
  • 6EU regions for the Amazon Bedrock “EU” profile
Read moreHide details

We will supervise your agents from our monitoring tool, in preparation. It will receive only indicators and alerts:

The content of your emails, invoices and files stays where your agents run. The only exception: the extracts sent to the AI model (see below). When an agent reports a problem itself, it will open a ticket with the technical detail (tool in preparation). Personal data is planned to be removed from it.

The AI model: where your texts are read

In short: on each call, the AI model reads an extract of your data. You can require that this reading takes place in the European Union. Another choice: an open model installed on your side, more costly in hardware, whose quality varies by model.

  • Amazon Bedrock, “EU” profile. Called from Paris, Frankfurt, Ireland, Milan, Spain or Stockholm, this profile processes requests in these six EU regions, and nowhere else. Called from London or Zurich, it adds those regions, which are outside the Union. So we will never call it from there. Amazon recommends checking the exact list of regions before use: we will do so at every go-live. According to Amazon, the model's publisher has access to neither the requests nor the responses.
  • Google Cloud, “Europe” endpoint. Claude Opus 5.5 has been available there since 22 September 2026. Google excludes countries outside the Union from this endpoint, including the United Kingdom and Switzerland.
Read moreHide details

The AI model is the engine that reads a text and writes a proposal. Our agents will rely on Claude, Anthropic's model. On each call, the agent will send it an extract of your data. Here is where that extract is read, based on sources checked on 13 October 2026.

Anthropic's direct access has no Europe option. Its API is the entry point through which a program calls the model. It processes requests in the United States or “anywhere in the world”. It stores data in the United States. When you require Europe, we will not use it for your data.

Two routes go through Europe:

At Amazon, depending on the model, exchanges may be kept for a limited time to detect abuse. Before go-live, we will tell you the setting applied, provider by provider.

An open model, installed at your premises. An “open” model is downloaded and installed on your machines: no text goes to an AI provider. Mistral AI, for example, publishes its Mistral 3 models under the free Apache 2.0 licence. The largest runs on a server with eight graphics processors (specialised, costly chips). The smallest are aimed at more modest machines. This choice costs more in hardware. And the quality of the suggestions varies from one model to another. We measure it during the shadow trial: a few weeks in which the agent suggests without acting.

Who pays for the AI model. Subscriptions and model usage (counted in tokens) are not included in our prices. You pay them directly to the provider, on your own account, or we re-invoice them to you at cost, with no margin. We track each agent's usage (see above): you know what you are paying. To keep it low, each task will be given to the most economical AI model that passes our quality test, tested and dated: a light model to sort or extract, a more powerful model only when the test shows it is needed.

The log: every action leaves a trace

In short: each agent will record what it read, what it suggested and who decided. This log will help us understand an error and respond to an audit.

  • what it read;
  • what it suggested;
  • your team's decision (approved, corrected, refused), who made it and when;
  • the version of the agent that did the work.
Read moreHide details

Each agent will keep a log: a register where it notes what it does. For each action, it will record:

This log is planned to stay within your installation. It will help us understand an error, respond to an audit and decide whether an agent can gain autonomy. Autonomy is set in four levels, from 0 (the agent only suggests) to 3 (it acts alone, under supervision). An agent only moves up a level if the measurements justify it, and with your written agreement. It will drop back automatically after a serious alert.

Some actions always remain subject to your approval: a payment, sending a third party a document that binds you, deleting data.

What the agents are allowed to touch: as little as possible

  • The minimum. Each connector (the link between the agent and one of your software tools) will receive the narrowest access possible, read-only where possible.
  • Written stop cases. At the slightest doubt, the agent stops and hands over: unreadable document, customer in dispute, request from a person exercising their rights over their data.
  • Tests without your real data. We test on anonymised data. A security review comes before go-live.
  • Frozen versions. Any update to an agent, tool or connector will go through a short acceptance test: a brief trial before applying it.

Reversibility and code ownership: what comes back to you

In short: reversibility means being able to leave with what is yours. The code of custom software is handed over to you and its rights are assigned to you by contract (a licence may cover the shared parts, see your quote); your personal data is returned or deleted, as you choose.

  • Custom software. On delivery, you receive the source code, the documentation, the inventory of the open-source licences used and the hosting access. The code repository (the space where the code is stored, with its history) is handed over to you. The rights to the code are assigned to you by contract.
  • Agents. Installed in your cloud or on your servers, they already run at your premises. What comes back to you at the end of the contract, and what remains a shared model maintained by us, is defined with you before set-up.
  • Your data. At the end of the service, we delete or return your personal data, as you choose. This is an obligation under Article 28 of the GDPR.
Read moreHide details

Anthropic's commercial terms recognise that the customer owns what the model produces, to the extent permitted by law. The assignment of the code to your company is then made by contract.

GDPR: who does what

In short: you decide how your data is used; we process it on your behalf. A data processing agreement is signed before we touch your data.

Read moreHide details

The GDPR (General Data Protection Regulation) shares out the roles:

  • You are the controller: you decide why and how your data is used.
  • We are the processor as soon as we process your data on your behalf (set-up, supervision, hosting).

Article 28 then requires a data processing agreement. We sign it before touching your data. This agreement provides in particular that the processor:

  • acts only on your documented instructions;
  • uses no other processor without your prior written authorisation (for example, depending on the set-up, the AI model provider if it is called from our account and not yours: to be checked with your adviser);
  • gives you the information needed to verify this, including audits;
  • deletes or returns the data at the end of the contract.

Each agent page also specifies the items to enter in your record of processing activities (Article 30), the document that lists what you do with personal data: which data, for what purpose, for how long.

EU AI Act: what concerns you

In short: the regulation has applied generally since 2 August 2026. What concerns you: the roles of deployer and provider, AI literacy among your staff, informing people who interact with an AI system, and high-risk uses, checked at the audit.

Read moreHide details

Regulation (EU) 2024/1689, amended in 2026 by Regulation (EU) 2026/1744, has applied generally since 2 August 2026.

  • Deployer and provider. The text calls “deployer” whoever uses an AI system under its own authority. It calls “provider” whoever develops it or has it developed, then places it on the market or puts it into service under its own name. Who holds which role depends on the set-up: we clarify this with you, to be checked with your adviser.
  • AI literacy (Article 4). Providers and deployers take measures to support the AI literacy of their staff. Since 2026, the text specifies that it does not require guaranteeing a precise level for each person. The hands-on support we provide at each set-up is part of this.
  • Transparency (Article 50). A person who interacts directly with an AI system must be informed of it, unless it is obvious. As a precaution, any agent that writes to your customers without review will tell them they are interacting with an AI system.
  • High-risk uses (Annex III). Employment and staff management, or assessing the creditworthiness of individuals, are on this list. The corresponding obligations apply from 2 December 2027. We check at the audit whether any of your uses falls under it, before building.

Next step: the audit

Everything starts with an audit. We review your tools, your volumes and the personal data involved. We also discuss where it will be installed. You receive a one-page report (tools, personal data, expected gains, agents useful to you) and a quote. The audit costs €490 excl. VAT.

Sources

Accessed on 13 October 2026.

  1. Anthropic, Claude Platform: Data residency (inference geo “us” and “global” only; workspace geo “us” only)
  2. AWS, Amazon Bedrock: Claude Opus 5.5, model card (EU geographic profile: source and destination regions)
  3. AWS, Amazon Bedrock: Claude Sonnet 5.5, model card (EU geographic profile: same destination regions)
  4. AWS, Amazon Bedrock: Supported Regions and models for inference profiles (check the destination regions, do not rely on the prefix alone)
  5. AWS, Amazon Bedrock: Geographic cross-Region inference (requests stay within the geography)
  6. AWS, Amazon Bedrock: Cross-Region inference (geographic or global)
  7. AWS, Amazon Bedrock: Data protection (model providers have no access to requests or responses)
  8. AWS, Amazon Bedrock: Data retention (possible retention to detect abuse, depending on the model)
  9. Google Cloud: Claude Opus 5.5 on Google Cloud (Europe multi-region availability, GA, released on 22/09/2026; page updated on 2026-10-09)
  10. Google Cloud, Vertex AI: Data residency (EU multi-region excluding the United Kingdom and Switzerland; global endpoint with no residency guarantee)
  11. Mistral AI: Introducing Mistral 3 (Apache 2.0 licence; Mistral Large 3 on an 8×A100 or 8×H100 node; Ministral 3 for light machines)
  12. CNIL, texte du RGPD, chapitre IV (art. 28 processor, §2 prior written authorisation, §3 a), g), h); art. 30 record)
  13. CNIL, texte du RGPD, chapitre I (art. 4, 7) controller, 8) processor)
  14. European Commission, AI Act Service Desk: Article 3 (definitions of provider and deployer)
  15. European Commission, AI Act Service Desk: Article 4 as amended by the Digital Omnibus (consolidated version of 27/07/2026)
  16. European Commission, AI Act Service Desk: Article 50 (transparency)
  17. European Commission, AI Act Service Desk: Article 113 (general application on 2 August 2026; Annex III on 2 December 2027)
  18. European Commission, AI Act Service Desk: Annex III (high-risk uses)
  19. Anthropic, Commercial Terms of Service, section B (the customer owns its Outputs; in force on 17/06/2025)

Next step

Tell us where your team loses time.

Everything starts with an audit: your tools, your ways of working, your volumes. You then receive a quote.

Book my audit