DELOS

GDPR overview

Concrete and unusually detailed for a vendor of this size. Delos Analytica states it is subject to the revised Swiss Federal Act on Data Protection and, where applicable, the GDPR; the privacy policy carries a dedicated section on rights under the GDPR alongside one on Swiss law, and names the Swiss FDPIC as competent authority. A standard data processing agreement is published and open to every customer, with a named sub-processor table giving contracting entity, purpose, data categories, processing location and transfer basis for each. Requests are acknowledged within five working days and answered substantively within thirty, free of charge. US transfers rely on the Swiss-U.S. and EU-U.S. Data Privacy Frameworks, with standard contractual clauses as fallback. Two gaps are worth naming: no EU representative under Article 27 is designated, although the company is established outside the EU, and no data protection officer is appointed, the vendor stating it is not required to.

Who owns the data?

Delos Analytica AG splits the two roles explicitly. For the content a customer feeds into the platform it acts as processor, and the customer organisation remains controller: the vendor takes only a non-exclusive licence to host, reproduce and adapt that content in order to run the service, and that licence ends when the content is returned or deleted. For account, authentication, billing and marketing data, and for the licensed news and public-record corpus it indexes, Delos Analytica acts as controller under its own privacy policy. Where a data subject request concerns an analysis a customer produced on the platform, the vendor forwards it to that customer rather than answering for them.

Reuse rights

Customer content is used only to provide and support the service. Both the terms and the data processing agreement state that it is not used to train or fine-tune machine learning models, not used to improve the service, and not used to build features for other customers; only aggregated and irreversibly anonymised usage data may inform product development. Model inference runs through the Vercel AI Gateway to OpenAI, Anthropic, Google and xAI with zero data retention enabled account-wide, so prompts and outputs are neither kept nor used for training by those providers. On the customer side, output is designed to be reused freely: every item carries a link back to its original source, briefings can be edited before distribution, and data can be exported in standard formats. Note that the underlying media corpus is licensed from third-party publishers and remains their property, so redistribution of that source material is governed by their terms rather than by the customer's own rights.

Data retention & training

Hosting summary

The site gives two incompatible accounts and both deserve to be read. The trust and security page states that production data is hosted in Switzerland in ISO/IEC 27001-certified data centres, with daily encrypted and geographically separated backups, and that no customer data leaves Swiss or EU jurisdiction without an explicit contractual agreement. The privacy policy and the data processing agreement instead place the primary application database, run on Neon, in the United States at aws-us-east-1 in Northern Virginia, with backups kept in the same region and no cross-region replication; other processing takes place in the European Union and in Switzerland, and a contracted engineering team in Uruguay accesses the systems remotely without storing personal data there. Principal infrastructure providers are Amazon Web Services, Vercel and Neon. Traffic is encrypted with TLS 1.2 or above and data at rest with AES-256. Transfers to the United States rely on the Swiss-U.S. and EU-U.S. Data Privacy Frameworks, with standard contractual clauses as a fallback; the United Kingdom and Uruguay are covered by adequacy.