• Switzerland data residency for documents, queries, prompts, completions, backups, and audit logs — data does not leave Swiss jurisdiction in the normal course of operation.
  • Swiss legal jurisdiction; compelled disclosure requires a Swiss court order. Non-Swiss authorities cannot compel access directly; the US CLOUD Act and equivalent extraterritorial demands do not reach Swiss-owned infrastructure operated under Swiss law.
  • Phoeniqs as the only sub-processor. No analytics vendors, no customer-success platforms, no third-party model providers that would expose your data outside the Steward–Phoeniqs boundary.
  • No training of any model on customer data — at either tier, ever. This commitment is not an opt-out toggle and is not tier-dependent.
  • 30-day workspace export on termination, 30-day deletion of all copies after the export is confirmed received, and residual operational audit logs retained for no more than 12 months before scheduled deletion.
  • Application-level workspace isolation, tested in the security suite that runs on every production change. Cross-workspace access is not possible through the application.
  • Controller / processor relationship governed by the Data Processing Agreement. The controller decides why and how the data is processed; Steward executes those instructions and nothing else.