Security & data protection
Negology is operated by TRDL in Denmark. This overview describes the current service. Your signed agreement and Data Processing Agreement define any customer-specific commitments.
Access and account protection
Accounts use individual authentication. Authenticator-app MFA is available, and company administrators can require it for active team members. Platform administrators must use MFA.
Roles and database access policies control access to training records. Designated managers can access their team’s training information; ordinary users do not receive general access to other teams.
Storage and international processing
The primary Supabase database and file storage are in Stockholm, Sweden (AWS eu-north-1). This does not mean every service, support activity or AI request is processed only in the EU.
ElevenLabs currently uses its standard US environment for Negology. EU voice residency is not currently enabled. An Enterprise migration would require a separate regional workspace and verified configuration.
OpenAI processes inputs for AI features. Resend stores email content and delivery data in the US. Other providers and their subprocessors may also process data internationally. See the Privacy Policy for purposes and transfer safeguards.
AI and confidential company content
Depending on the feature, providers process audio, transcripts, prompts, company materials, uploaded documents, screen images and relevant technical identifiers. Review materials before uploading and remove unnecessary personal information.
Company materials and derived cases are covered by our confidentiality terms. Access for support and security is limited to what is needed for the request, incident or legal obligation. Google Calendar information has additional access restrictions described in the Privacy Policy.
Retention and data requests
Team administrators can set the session-content retention period from 1 to 365 days; the default is 180 days. Scores and progress have a separate retention purpose. Scheduled cleanup processes eligible session recordings and transcripts.
Account deletion, organisation termination, uploaded materials and provider copies require their own cleanup steps. Contact us for a data export, deletion request or a customer-specific retention requirement. The Privacy Policy explains these distinctions.
Security assurance
The service uses HTTPS, provider-managed encryption for primary storage, and access controls. We maintain application security checks and review changes affecting authentication and data access.
Negology does not currently hold its own ISO 27001 certification or SOC 2 report. Supplier certifications apply to those suppliers and their audited services; they do not certify Negology.
A security questionnaire, our DPA and information about technical and organisational measures are available for customer review. We agree additional requirements in writing rather than assume they are included.
Support and security reports
Contact troels@negology.com for security concerns, suspected unauthorised access or a procurement review. Include the affected feature, time and a minimal description. Do not email passwords, API keys or complete customer recordings.
We investigate reported incidents and notify affected customer controllers of personal data breaches without undue delay under the applicable DPA. Contractual support hours, response targets and any SLA are agreed separately.