Trust & compliance
Trust Center
Last updated: 13 October 2026
What SUUS IQ does to protect customer data, which documents are public and where we stand per law and standard. Everything on this page is true today.
Supplier questionnaire or audit question? Email info@suusiq.com. Reply within five working days.
Data
Database in the EU
GDPR
DPA + public sub-processors
Access
MFA required for admins
Audit
Supplier questionnaire on request
Laws and standards
AVG / GDPR
In place
Applies. SUUS is a processor on behalf of the customer; the customer is the controller.
What it is about
- A processor may only process personal data on the instructions of the customer, laid down in a data processing agreement (art. 28).
- Sub-processors only with the consent of the customer and under the same terms.
- Appropriate security (art. 32), notifying a data breach without undue delay (art. 33) and helping the customer with requests from data subjects.
- Transfers outside the EEA only on a valid legal basis, such as standard contractual clauses.
Where SUUS stands
- Data processing agreement (DPA) as part of every agreement: security measures, data breaches notified within 24 hours at the latest, audit right, and return or deletion of the data at the end.
- Public list of sub-processors with, per vendor, purpose, data, location, transfer basis and a concluded DPA.
- Export and deletion of all customer data on request. Audio of voice calls is deleted no later than 24 hours after recording; transcripts and summaries belong to the customer’s CRM and are included in export and deletion.
- Audit log per organisation and an incident runbook: customers within 24 hours after a confirmed data breach, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours, every incident in a register (see Incidents and continuity).
GDPR, official text (EUR-Lex)Data processing agreementSub-processorsPrivacy policy
EU Data Act
In place
Applies as a cloud service (chapter VI, switching).
What it is about
- A customer must be able to switch to another provider or to their own systems, with all data in an open, machine-readable format.
- The exit information (what is included, how, within which period) belongs in the agreement.
- Switching charges are being phased out and are prohibited from 12 January 2027; a transition period of 30 days, extendable once, is the norm.
Where SUUS stands
- The Switching and export page is part of the agreement (Terms article 10): one month’s notice, a transition period of 30 days that the customer can extend once, and a list of what is and is not included.
- Export on request, within five working days, free of charge, also during the term. The automated export delivers JSON of the core of the CRM: organisation, users, accounts, visits, notes, tasks, appointments, opportunities, conversations, usage and audit log.
- After cancellation the data remains retrievable for 30 days (grace period with soft delete), then deletion; database backups expire within seven days.
- Switching mid-term is always possible with one month’s notice; the subscription fees for the remainder of the current term remain due. There are no other charges.
NIS2
Partially applicable
Not directly: SUUS falls under none of the sectors and stays below the size threshold. Indirectly, yes, as a vendor to customers that are in scope themselves (such as the food industry) and must assess their suppliers.
What it is about
- Essential and important entities must take ten security measures (article 21): risk analysis and policy, incident handling, continuity and backup, supply chain security, secure development and vulnerabilities, assessing effectiveness, cyber hygiene and training, encryption, personnel and access, and multi-factor authentication.
- They must assess their suppliers on those same points; that is why SUUS receives the questions.
- They report significant incidents within 24 hours (initial notification) and 72 hours (detailed), so they need their suppliers quickly.
- In the Netherlands implemented in the Cyberbeveiligingswet (Cybersecurity Act); the entity’s management is personally liable.
Where SUUS stands
- For each measure of article 21, what SUUS does is listed below, in the format of a supplier questionnaire. A completed questionnaire of the customer’s own follows within five working days.
NIS2 Directive, official text (EUR-Lex)Data processing agreementSub-processors
The measures of article 21
Risk analysis and security policy
The rules exist as runbooks (incidents, key rotation, deployment) and as automated checks that block every change.
Incident handling
Runbook with severity classes, customers within 24 hours after a confirmed data breach, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours, incident register, annual exercise (first in April 2027). Those 24 hours are also in the data processing agreement (article 5).
Continuity, backup and recovery
Daily database backup, kept for seven days; hosting with vendors that have their own redundancy; independent monitor with a public status page (status.suusiq.com); the terms and conditions state a target of 99.5% availability without guarantee.
Supply chain security
Public list of sub-processors with, per vendor, a concluded data processing agreement and verified certifications; changes announced 14 days in advance.
Secure development and vulnerability handling
Five security audits and the security test suite on every change, dependencies without known vulnerabilities, patches applied immediately, public reporting address with acknowledgement within two working days.
Cyber hygiene and training
The security rules are part of the development guidelines that every change must pass, and of the runbooks; whoever works on SUUS works with them.
Encryption
TLS for all traffic, encryption at rest with the hosting vendors, integration tokens separately encrypted at application level, key rotation every six months.
Personnel, access control and assets
Roles per user, employees only see their own and unassigned accounts, administrative access to the infrastructure limited to a small number of administrators with MFA.
Multi-factor authentication and secured communication
MFA mandatory for administrators and managers, enforceable by the organisation for everyone; no access to customer data without a second factor. Voice and chat run over encrypted connections.
EU AI Act
In place
Applies, limited risk. SUUS uses AI for speech recognition, summarising, scoring and an assistant; none of the features is on the list of high-risk systems, one feature comes close and therefore has three safeguards.
What it is about
- AI systems are classified by risk: prohibited, high, limited or minimal.
- Limited risk requires transparency: a person must know they are dealing with AI (art. 50).
- Annex III is the list of high-risk applications: biometrics, critical infrastructure, education, employment and workers, essential services, law enforcement, migration and the administration of justice. For SUUS only "employment and workers" counts, which includes AI that monitors or evaluates the performance or behaviour of employees. Such AI requires a conformity assessment, unless it only performs a narrow procedural task and does not replace human assessment (art. 6(3)).
- Whoever deploys AI must ensure users understand it sufficiently (art. 4) and maintains human oversight.
Where SUUS stands
- The voice assistant introduces herself by name, not as AI. The terms and conditions (article 5) oblige the customer to tell their users that they are working with AI functionality and to keep human oversight of it. In the chat the assistant is recognisable as an assistant.
- The assistant writes nothing to the CRM without confirmation from the user; logging a visit by phone is the instruction itself.
- No automated decisions with legal effect on persons. There are automatic scores: an A–D ranking of accounts and a score of lead requests, as an aid to prioritising. A person decides what happens with them.
- The Team overview and the management questions to the assistant show work activity per employee (visits, follow-up, data entry, tasks), not a judgement. The nightly "management coach" turns those facts into suggestions for the manager with a language model, such as a coaching conversation about follow-up. This is the feature that comes closest to Annex III; that is why there are three safeguards.
- Safeguard 1, in the code: the assistant refuses every request for a judgement or personnel measure about a person (dismissal, who is lazy, salary) with a fixed sentence and offers the work figures instead; a suggestion from the coach that mentions a personnel measure is filtered out automatically. Both are tested, the assistant against the real model.
- Safeguard 2, in the contract: terms and conditions article 5. SUUS only shows work activity about users and at most suggests a conversation or help; the customer does not use the Service to evaluate the performance or emotions of employees with AI.
- Safeguard 3, on paper: the assessment of every AI feature against the AI Act (article 6(3)) is documented and available on request.
- SUUS does use transcripts to improve its own recognition and assistant (quality control, test cases), within the agreement (Terms article 5). Never to train third-party models and never shared with other customers; agreed with or switched off at the model vendors (opt-out).
Where the data is
Per sub-processor where customer data is stored and processed, and on what basis when that is outside the EEA. The same facts as on the Sub-processors page, sorted here by location.
Storage and processing in the EEA
Everything stays within the European Economic Area. No transfer.
Supabase
EU (Ierland, AWS eu-west-1)
Upstash
EU (Frankfurt, AWS eu-central-1)
Deepgram
EU (EU-endpoint van Deepgram)
Speechmatics
EU (EU1-endpoint, verwerking binnen de EER)
Storage in the EEA, part of the processing outside it
The customer data is in the EEA, but logs, account data, session data or support partly run via the US. Legal basis per vendor.
Vercel
Servers in de EU (Frankfurt); Vercel verwerkt daarnaast in de VS
Basis: EU-VS Data Privacy Framework en standaardcontractbepalingen (SCC)
Trigger.dev
Uitvoering in de EU (Frankfurt); taakgegevens en logs in de VS (AWS us-east-1)
Basis: Verenigd Koninkrijk: adequaatheidsbesluit van de Europese Commissie; naar de VS via SCC met hun sub-verwerkers
Sentry
EU (Duitsland); account- en organisatiegegevens in de VS
Basis: EU-VS Data Privacy Framework, met standaardcontractbepalingen (SCC) als terugval
LiveKit Cloud
Voice-agent in de EU (Frankfurt); live-audio via de dichtstbijzijnde LiveKit-server (voor gebruikers in Nederland en België in de EU); sessiegegevens en logs in de VS. Gespreksopnames en transcripten slaat LiveKit niet op
Basis: EU-VS Data Privacy Framework, met standaardcontractbepalingen (SCC) als terugval
Meta (WhatsApp Business Platform)
EU (Ierland) en VS
Basis: WhatsApp Ireland verwerkt in de EU; doorgifte aan Meta Platforms, Inc. via het WhatsApp Business Data Transfer Addendum, onderdeel van de verwerkersvoorwaarden
Processing outside the EEA
The vendor (also) processes outside the EEA, usually in the US. Transfer on the basis of the EU-US Data Privacy Framework, standard contractual clauses or an adequacy decision (UK).
Resend
Verzending vanuit de EU (Ierland); opslag in de VS
Basis: EU-VS Data Privacy Framework en standaardcontractbepalingen (SCC)
OpenAI
VS
Basis: Standaardcontractbepalingen (SCC), onderdeel van de DPA
Cartesia
VS
Basis: Standaardcontractbepalingen (SCC, module 2), onderdeel van de DPA
Nylas
Verenigd Koninkrijk (Londen)
Basis: Verenigd Koninkrijk: adequaatheidsbesluit van de Europese Commissie; naar de VS via het EU-VS Data Privacy Framework en SCC (module 3, in de DPA)
Apify
VS (Amazon Web Services en MongoDB Atlas)
Basis: Standaardcontractbepalingen (SCC), onderdeel van de DPA
Higgsfield
VS
Basis: Geen doorgifte van persoonsgegevens: de beeldopdrachten bevatten die niet
Twilio
VS
Basis: Bindende bedrijfsvoorschriften (BCR), EU-VS Data Privacy Framework en SCC
Google Workspace
Wereldwijd (datacenters van Google)
Basis: EU-VS Data Privacy Framework en standaardcontractbepalingen (SCC)
Anthropic
VS
Basis: Standaardcontractbepalingen (SCC), onderdeel van de DPA
Controls
Infrastructure and data
Hosting in the EU
Database, sign-in and file storage in Ireland, the application in Frankfurt. Which vendors additionally process outside the EEA is listed above under Where the data is.
Encryption
All traffic over TLS, data at rest encrypted (AES-256), customers’ integration tokens additionally encrypted at application level.
Separation between customers
Every row in the database belongs to one organisation and the database refuses access across that boundary. After every database change an automated test tries, as a real user, to read data of another organisation.
Backups
Daily database backup, kept for seven days. Point-in-time recovery is available as an upgrade on request.
Availability
An independent monitor checks every three minutes from the EU whether the website, the application and the database are reachable; the voice agent reports in every five minutes. Outages and the measured availability per component are on the public status page.
Status pageAccess and identity
Two-factor authentication
Mandatory for administrators and managers, enforceable by the organisation for everyone. No access to customer data without a second factor.
Roles
Administrator, manager, employee and viewer. Employees only see their own and unassigned accounts. Every data access declares which role may call it; without that declaration the code cannot go live.
Audit log
Sign-ins, password and MFA changes, settings, exports and all changes to accounts, tasks and appointments, per organisation. Append-only, never modified; visible to administrators and managers.
Access by SUUS itself
Viewing a customer environment only for support or error analysis, with a fresh second factor from the SUUS administrator; every session is logged and expires after two hours. That this only happens at the customer’s request is a working agreement, not a technical block. Administrative access to the infrastructure is limited to a small number of administrators with MFA.
Development and operations
Every change checked
Automated security audits and a test suite with security scenarios block a change that crosses a boundary, before it can go live. After every deployment the security tests run again against production.
Dependencies
No known vulnerabilities in the production dependencies, checked automatically. Security patches are applied immediately.
Secrets
Keys are never in code or logs. Rotation every six months, when someone with access leaves, and after every audit finding.
Protection of the app
Strict Content Security Policy, rate limiting on sign-in, AI and form paths, and verification of every external link and redirect.
Vendors
Data processing agreement with every vendor
Every sub-processor has a concluded data processing agreement, with standard contractual clauses where needed. Signed copies on request for an audit.
Changes 14 days in advance
We announce a new or replaced sub-processor at least 14 days in advance; the customer can object and, if necessary, cancel free of charge.
Fallback during an outage
Speech recognition and the assistant’s voice automatically switch to a fallback at a vendor with whom a data processing agreement already exists during an outage.
AI and voice
No training on customer data
The model vendors do not train on customer data; that is in their data processing agreement. SUUS does use transcripts for quality control and test cases (Terms article 5), never shared with other customers.
Recordings gone within 24 hours
Audio of voice calls is deleted no later than 24 hours after recording. Only the transcript and the summary remain, as part of the customer’s CRM.
Transparent
In the chat the assistant is recognisable as an assistant; by phone she introduces herself by name and the customer informs their users that it is AI. Tasks, appointments and changes are only recorded by the assistant after confirmation; a dictated visit report is the instruction itself.
Incidents and continuity
Summary of our incident runbook; the runbook itself goes to customers on request.
Notification to customers
For a confirmed data breach within 24 hours after we know; for a suspicion, a compromised account or an outage longer than an hour within 72 hours. First what is known, then the rest.
What a notification contains
What happened, which data and of how many persons, possible consequences, what SUUS did, what the customer needs to do and when the next update comes.
Dutch Data Protection Authority
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours when personal data is involved, unless the breach is unlikely to pose a risk. We always record that assessment in the incident register, also when we do not report.
Runbook and exercise
Contain, secure evidence, recover with a test that guards the gap, notify, evaluation within a week. Annual dry run, first in April 2027.
Exit without barriers
All customer data exportable in an open format; retrievable for 30 days after the end of the agreement, then deleted. Export and switching cost nothing.
Public
On request
- Signed data processing agreements with sub-processors
For an audit, per vendor.
- Completed supplier questionnaire
Your own questionnaire, or SIG Lite / CAIQ. Within five working days.
- Summary of the internal security audit (October 2026)
Scope, findings and resolution.
- AI Act risk assessment
Per AI feature the classification and legal basis (Terms article 5).
- Incident runbook and rotation policy
The full playbooks for data breaches and key rotation, and the incident register.
Email info@suusiq.com. Signed data processing agreements of suppliers may require a non-disclosure agreement.
Found a vulnerability?
Report it to info@suusiq.com with steps to reproduce it. We confirm within two working days, keep you informed of the handling and take no legal action against good-faith research that does not touch customer data. Machine-readable: security.txt.