Skip to main content
For a summary of our security practices, visit our Security page.
Your data is safe with Libra. We guarantee that your data, inputs (prompts), and outputs (completions) are:
  • NOT available to other customers
  • NOT available to any entities outside the EU/EEA
  • NOT used to improve or train any AI models
  • NOT used to improve any third-party products or services

​
Data Processing Agreement

Our data processing agreement (DPA) is integrated into our General Terms and Conditions. The DPA:
  • Defines the scope and purpose of data processing
  • Specifies the types of personal data processed
  • Lists all subcontractors who process data on our behalf
  • Establishes the technical and organizational measures we implement
Our terms, including the DPA, are available at libratech.ai/terms. Terms may vary by country.

​
Your Rights Under GDPR

As a data subject, you have the right to:
RightDescription
AccessRequest information about what data we hold about you
RectificationRequest correction of inaccurate data
ErasureRequest deletion of your data
PortabilityRequest a copy of your data in a portable format
RestrictionRequest limitation of processing
ObjectionObject to certain types of processing
To exercise these rights, contact your organization’s administrator or Libra support.

​
Data Storage and Encryption

All user data is protected with industry-standard encryption:
ProtectionMethod
Data in transitTLS protocol (HTTPS)
Data at restXTS-AES-256-bit encryption
Storage locationServers in Germany
AI processingEU-based servers only
All user data, including chat histories and uploaded documents, is stored in encrypted form on servers in Germany. When generating responses, inputs are transmitted to AI model providers whose servers are located exclusively within Europe (for example, OpenAI models are hosted via Microsoft Azure’s European service). No data is transferred to the United States.

​
How We Protect Your Data

Unencrypted access to user data is restricted to Libra employees who need access to fulfill contractual obligations. These employees are bound by confidentiality agreements in accordance with § 203 StGB. Third parties do not have unencrypted access.Within your organization, you can share documents, chats, and assistants with colleagues. Sharing outside your organization is restricted. Your administrator controls organization-wide settings.
When Libra processes your requests:
  1. Relevant content is sent to AI model providers
  2. Processing occurs on servers within the EU
  3. Data is not stored on AI provider servers after processing
  4. Your data is never used to train AI models
Our data processing agreements with AI providers explicitly prohibit using customer data for model training.
We carefully select subprocessors who process data on our behalf. All subprocessors are GDPR-compliant, ISO 27001 certified, and have servers located in the EU/EEA.
SubprocessorServiceLocation
Open Telekom CloudCloud providerGermany
Microsoft AzureCloud providerEU/EEA
Amazon Web ServicesCloud providerEU
DeepLTranslationEU
The complete list is available in our Security page.
All data processing occurs within the European Economic Area (EEA):
  • User data is stored in Germany
  • AI processing occurs on EU-based servers
  • No data is transferred to the United States
For GDPR questions or to exercise your rights: privacy@libratech.aiFor documentation (TOMs, subcontractor list), visit the Security page. Our terms, including the DPA, are available at libratech.ai/terms.

​
Security Controls

Libra maintains comprehensive security controls verified through our Security page:
  • Capacity management: Resource utilization is monitored and adjusted to meet current and projected requirements
  • Password policies: All system components are configured according to enterprise security policies
  • Business continuity plans: Documented BC/DR plans with defined communication channels to ensure information security continuity
  • Annual testing: BC/DR plans are tested annually
  • ICT readiness: Planned, implemented, maintained, and tested based on business continuity objectives
  • Data backup: Regular backups of information, software, and systems with periodic recovery testing
  • Incident response: Documented security and privacy incident response policies communicated to authorized users
  • Supplier management: Information security requirements defined and contractually agreed with all suppliers
  • Incident planning: Processes, roles, and responsibilities for information security incident management
  • Encrypted transmission: Secure protocols ensure encryption of confidential data during transmission over public networks
  • Encrypted remote access: Remote access to production systems is restricted to authorized employees via approved, encrypted connections only
  • Data encryption at rest: Storage systems containing sensitive customer data are protected with appropriate encryption
  • Privacy impact assessments: Conducted for processing activities that pose high risks to data subjects’ rights and freedoms