Skip to content
Sign in

Trust center

We know that you asked. Never what you asked.

Your question passes through us once, on its way to the AI model you chose. We add the law, and keep a record that it happened.

Reporting a vulnerability

  • Questions are not kept

    We do not store the text of your questions or the answers, unless your organisation turns that on.

  • Your AI, under your agreement

    Bring your own model and key. Your provider works for you, not for us.

  • Passkeys and a second step

    Sign in with a passkey, and add an authenticator app as a second step.

  • An audit log you can check

    Append-only, and exported with a signature you verify offline, without us.

  • Nothing from anyone else

    No trackers, no third-party scripts, no advertising. Only the cookie that signs you in.

  • Hosted in the EU

    Servers and backups in Germany.

Built so that we have less to protect.

  • Your questions are kept only if your organisation chooses

    For each request we record who, when, which tool, which documents were read, tokens and outcome. That is what it takes to run and count the service. A log line carrying question text is dropped before it is written.

    Questions and answers are not stored unless your organisation turns on question history. Then they are encrypted with your organisation's own key, kept for the period it sets and deleted after it, and any time Gelex staff open your account it is written to your organisation's audit log.

  • Your AI provider works for you, not for us

    We run no language model of our own. Your organisation connects its own key for any OpenAI- or Anthropic-compatible API, including a model you host yourself, or uses the assistant it already has through the connector.

    Keys are checked before saving, stored encrypted and never shown again. Your provider is your processor, under your agreement with it.

  • Nobody can edit the audit log, including us

    Membership, role and key changes, and each question asked without its text, are written to a log that the application cannot change or delete. IP addresses are stored only as hashes.

    Owners download it with a signature and check it against our published key, offline.

  • The law is the publisher's own file

    Texts, versions, dates and grades come from deterministic code and the publisher's own files. AI only writes answers, and they are labelled as such.

    Every citation shows a fingerprint of the file it came from, so you can compare it with the publisher's.

What you get.

Signing in

  • Passkeys

    Your fingerprint, face or security key instead of a password.

  • Two-step sign-in

    An authenticator app as a second step.

  • Strong passwords

    At least 12 characters, never your email address.

  • Lockout

    Sign-in pauses after repeated failed attempts.

  • Single sign-on

    Through your organisation's identity provider.

Your data

  • Export

    Your profile, memberships, sessions, usage, API keys and audit entries as one file.

  • Deletion

    Delete your account and everything only you can see.

  • Retention

    Fixed periods, from 24 hours for failed sign-ins to 5 years for invoices.

  • Encrypted in transit

    HTTPS only; your browser refuses anything else.

For your organisation

  • Roles

    Owners and admins manage members, keys and the AI connection.

  • Scoped API keys

    Each key gets only the access you tick, is shown once, and is revoked at once.

  • AI and data policy

    Decide whether question history is kept and whether members may use their own AI.

  • Signed audit export

    Who did what and when, in a file that verifies without us.

Papers for your review.

We hold no security certification yet, and there is no independent penetration test to show you. When there is, it will be listed here with its date.

Where we stand today.

  • SOC 2 and ISO 27001

    Not started: we hold neither. When an audit begins, it is named here with its dates.

    Not started
  • Penetration test

    No independent test has been done yet. When one is, it is listed here with its date.

    Not started
  • Breach notice

    Affected organisations are told without undue delay, and we aim to within 48 hours.

    In place
  • Support

    Write to support@gelex.eu. A person answers within two working days.

    In place

If something goes wrong.

A personal data breach follows the same steps every time. They are commitments in our data processing agreement.

  1. We contain it first: revoke the access, rotate the keys, close the hole.
  2. We tell each affected organisation without undue delay, and aim to within 48 hours of becoming aware: what happened, which data, what we have done and what you should do.
  3. Where we are the controller and the law requires it, we notify the Danish Data Protection Agency within 72 hours. We help you meet your own duties to yours.
  4. We record every breach, with its facts, effects and fixes.

Questions.

Found a weakness?

Tell us privately first. Research in good faith is welcome and protected.

security@gelex.eu
  1. Use only accounts you own or have permission to test with. If you reach other people's data, stop and tell us.
  2. No denial of service, no spam, no social engineering of our staff or customers.
  3. Give us a reasonable time to fix the issue before you publish, and agree the date with us.