where your data lives
Our websites run on a server we manage ourselves at GleSYS, a Swedish hosting company, in its data centre in Falkenberg, Sweden. Our databases and the server code for our other apps run in Stockholm. The AI model we mainly use is Claude, from the US company Anthropic, which processes requests outside the EU under the EU's Standard Contractual Clauses.
For client work you choose where the AI runs: our standard setup as above, processing only in EU data centres, or only European-owned providers. We are setting up and testing the EU options now, and we tell you exactly what each one can and cannot promise.
Our direct suppliers: GleSYS (website hosting; a Swedish company, data centre in Falkenberg), Vercel (hosting for our other apps; a US company, server code in Stockholm), Supabase (database; a US company, data in Stockholm), Anthropic (AI models; US) and Simply.com (domains and email; Denmark). Our contract with you lists every supplier that touches your data.
privacy and gdpr
When we handle personal data for you, we are your data processor under a written data processing agreement. We keep personal data out of AI prompts wherever we can, and the AI providers we use do not train their models on your data. For this website, see our privacy page.
privacy →
security
Two-factor login on our key accounts, secrets kept out of code, database access rules that are tested automatically, and a separate key with a spending limit for every AI app. We test every AI assistant with hostile and tricky questions before launch and after every change. We use the ISO standards for information security (ISO/IEC 27001) and for managing AI (ISO/IEC 42001).
ai safety
Our AI tools never send anything to anyone on their own: a person approves anything that leaves an organisation. Our assistants always say they are AI, answer from the sources they are given, and say when they don't know. They can still make mistakes, so important answers get checked.
When AI helps write texts for the public, a named person checks the facts and takes editorial responsibility, as the EU AI Act asks.
backups
Our systems are backed up automatically every night, to two separate places. When a project ends, we hand back your data and delete our copies.
the companies behind the models
Anthropic, which makes Claude, holds ISO 27001, ISO 42001 and SOC 2 certifications (March 2026). These certifications are Anthropic's own. It does not train its models on data sent through its business API, and deletes that data within 30 days by default.
websites
Light: we keep pages small. Images are resized and converted to modern formats, fonts come from our own site, and there are no tracking scripts, no cookies and no outside code. Every page shows its own estimated footprint (see environment above).
Accessible: clear contrast, readable text, a skip link for keyboard users, descriptions for images, and the right language set on every page in every language. We test our pages with automated checks against WCAG 2.2 level AA; on 27 October 2026 they found no problems. Automated checks don’t catch everything, so please tell us if something doesn’t work for you.
Ready for the rules: we build with the European Accessibility Act, data protection and cookie rules, and the new EU rules on environmental claims in mind, and we help clients keep up as the rules change. We offer the same check of footprint and accessibility for websites you already have.
on request
Our data processing agreement, the full list of suppliers, and short summaries of how we handle access, backups, incidents and AI use. Write to contact@onehemisphere.se.
← back