Lector was built for organisations where data protection is not optional — it is a legal obligation. Whether in our European cloud, hybrid, or fully on-premise in your own network: here you’ll find everything you need to know.
Security
Data centres in Germany (OVHcloud) – ISO 27001 and BSI C5 Type 2 certified
No data transfer outside the EU
Kubernetes-based infrastructure with automated deployment
AI models hosted exclusively in Europe (OVHcloud, Google Vertex AI, Microsoft Azure, Scaleway) – all providers ISO 27001 certified
TLS-encrypted communication (in transit)
AES-256 encryption of stored data (at rest)
GDPR compliant data processing
Data processing agreement (DPA) and
technical and organisational measures (TOMs) available
No use of your data for model training, no storage by the AI providers
Role-based access control (RBAC)
Single sign-on (SSO) via Keycloak
Audit logging of all security-relevant actions
Least privilege principle
ISO 27001: certification planned for 2026
GDPR compliant operations since the company was founded
Information security management system (ISMS) established in line with ISO 27001
Regular internal security reviews; external penetration tests in preparation
Deployment
For maximum control we offer hybrid and on-premise deployment alongside our cloud solution.
Start instantly, scale instantly
Use the full power of Lector as SaaS, always up to date.
Usage-based pricing
Try It FreeThe best of both worlds
Use the power of state-of-the-art LLMs from the cloud within your own infrastructure.
Custom pricing
Get in TouchFull control, full sovereignty
Run Lector in your own network with maximum data sovereignty.
Custom pricing
Get in TouchFrequently Asked
In the Lector Cloud, the platform runs on OVHcloud infrastructure in Germany. AI processing via Google Vertex AI and Microsoft Azure also takes place on European servers — the data is only there for the duration of processing and is deleted immediately afterwards. You decide how long Lector retains your documents. With hybrid or on-premise deployment, your data stays on your own servers.
No. The AI models use your data for processing only; with models from the cloud, it is deleted there immediately afterwards.
TLS encryption in transit, AES-256 at rest, role-based access control, single sign-on via Keycloak and audit logging of all security-relevant actions.
Yes. The data processing agreement including technical and organisational measures, the EU AI Act statement and further documents are in the Legal Center.
Yes — fully on-premise in your own network, including the platform and the AI models, or hybrid (your data stays with you, the AI models come from the cloud). The deployment options are described above.
Evidence
The key documents for data-protection and IT-security reviews are ready in the Legal Center – no request, no waiting.
Classifying and reading documents falls under recital 53 of the AI Act into the minimal-risk category – no high-risk obligations. Our assessment is there to read.
Read the Assessment →For every AI provider we use – Google Vertex AI, Microsoft Azure OpenAI, OVHcloud, Scaleway – we document the no-training commitment individually.
View the Evidence →Data processing agreement under Art. 28 GDPR with a description of the processing, the TOM checklist and the list of approved sub-processors.
Open the DPA →Legal
You will find all relevant security and data protection documents in our Legal Center.
