AI your compliance team can sign off.
Data protection, regulation and auditability are not an appendix to our platform — they are requirements we engineer against from day one.
Four pillars, built into every deployment.
Data protection (GDPR / revFADP)
Your data is processed under Swiss and EU data protection law — GDPR and the revised Swiss FADP. Processing locations are agreed contractually and kept in region (Switzerland/EU) wherever required. Your data is never used to train third-party models, personal data is minimised before it reaches any model, and data processing agreements, records of processing and deletion concepts are part of the delivery, not an afterthought.
EU AI Act readiness
We classify every agent against the EU AI Act's risk categories before it is built, and design the required controls into the system: transparency towards users who interact with AI, human oversight for consequential decisions, technical documentation and logging that satisfy the regulation's record-keeping duties. When your auditor asks how the AI decided, there is a documented answer.
Security
Encryption in transit and at rest, least-privilege connectors with scoped permissions, secrets management, network isolation and continuous monitoring are the baseline of every deployment. Our practices are aligned with ISO 27001; access to your systems is granted per integration, logged completely, and revocable at any moment — by you, not just by us.
Auditability
Every agent action is written to an immutable audit log together with the inputs and reasoning that led to it. Escalations, approvals and overrides are recorded with the person involved. That means any decision can be reconstructed after the fact — for internal review, for your regulator, or simply to understand and improve the process.
How we differ from other AI providers.
Swiss provider with roots in regulated electricity trading
CetAI is based in Switzerland and comes from electricity trading — an industry with strict supervision, regular audits and hard limits. We bring that discipline to AI: controls first, then speed. Data residency in Switzerland or the EU is a configuration, not a special request.
Guardrails enforced by the platform, not the prompt
Many providers implement safety as instructions in a prompt and hope the model complies. Our guardrails — approval requirements, spend limits, blocked operations — are enforced by the platform layer. An agent physically cannot execute an action its connector does not expose, no matter what the model generates. That distinction is what turns a promise into a control.
Your data stays yours
No training on your data, no cross-customer pooling, no silent product analytics on your content. We are model-agnostic: because we orchestrate multiple providers behind one interface, we can choose deployments that meet your data requirements — and replace any provider that changes its terms, without touching your processes.
We describe our working practices here, not certifications. Which formal attestations apply to your deployment is defined in the respective contract.