• Switzerland data residency for documents, queries, prompts, completions, backups, and audit logs — data does not leave Swiss jurisdiction in the normal course of operation.
  • Swiss legal jurisdiction; compelled disclosure requires a Swiss court order. Non-Swiss authorities cannot compel access directly; the US CLOUD Act and equivalent extraterritorial demands do not reach Swiss-owned infrastructure operated under Swiss law.
  • Phoeniqs as the only sub-processor. No analytics vendors, no customer-success platforms, no third-party model providers that would expose your data outside the Steward–Phoeniqs boundary.
  • No training of any model on customer data — at either tier, ever. This commitment is not an opt-out toggle and is not tier-dependent.
  • 30-day workspace export on termination, workspace deletion that blocks access immediately and retains workspace data for 30 days before hard deletion, and operational audit logs retained for seven years by default.
  • Application-level workspace isolation, tested in the security suite that runs on every production change. Cross-workspace access is not possible through the application.
  • Controller / processor relationship governed by the Data Processing Agreement. The controller decides why and how the data is processed; Steward executes those instructions and nothing else.