Security and GDPR page — Sally

Cited by

Facts read from this source

• GDPR claim Report an error

  “100% GDPR compliant Our solution fully adheres to the GDPR — ensuring maximum security and legal compliance.”

• Location Report an error

  “Hosted in Germany All personal data remains securely stored in Europe. We host exclusively with trusted European data centers.”

• Certifications list Report an error

  “ISO 9001 · 14001 · 27001 GDPR-compliant BAFA-listed AZAV-certified”

• Provider Report an error

  “All personal data collected while using Sally is securely stored on servers in Germany at Hetzner.”

• Third country transfers Report an error

  “No third-country data transfers. All components run in German data centers.”

• Certification body Report an error

  “Our integrated management system is certified by DICIS (Digital Institute for the Certification of International Standards) against the standards of ISO 17021 and ISO 27006, register no. 260526 14 IMS, valid until 26 May 2028”

• ISO standards Report an error

  “ISO 27001:2022: Information Security Management, externally audited. ISO 9001:2015: Quality Management. ISO 14001:2015: Environmental Management. ISO 42001:2023: AI Management System.”

• Dora Report an error

  “DORA: Digital Operational Resilience Act compliance for the financial sector.”

• EU AI act Report an error

  “EU AI Act: Classified as a limited-risk system with automatic transparency notices.”

• AI infrastructure Report an error

  “All AI processing runs on our own language model on our own infrastructure in Germany. Your data is never used to train language models.”

• Custom llm option Report an error

  “Option to integrate your own LLM or on-premises hosting for maximum control.”

• Documentation Report an error

  “We provide a full, transparent subprocessor list and our technical and organizational measures (TOMs) as downloadable documents.”

• Encryption Report an error

  “Encryption: AES-256 at rest, TLS 1.3 in transit.”

• Access controls Report an error

  “Access controls: Multi-factor authentication and role-based permissions (RBAC) following the least-privilege principle.”

• Tenant isolation Report an error

  “Tenant isolation: Data is strictly isolated per organization.”

• Audit logs Report an error

  “Audit logs: Complete logging of all access events.”

• Backups Report an error

  “Backups: Geo-redundant backups in ISO 27001-certified data centers in Germany.”

• Penetration tests Report an error

  “Penetration tests: Annual tests by external security firms.”

• Dpia Report an error

  “Data Protection Impact Assessment (DPIA) under Article 35 GDPR and regular internal audits.”

• Incident notification Report an error

  “Incident notification: Customers are notified of security incidents within 24 hours.”

• DPA Report an error

  “We sign a Data Processing Agreement (DPA / AVV) with every customer in accordance with Article 28 GDPR.”

• DPA process Report an error

  “Personalized DPA auto-generated and digitally signable online. Alternatively: download the DPA (English or German), sign, and email to privacy@sally.io, countersignature within 1 to 3 business days.”

• Opt out Report an error

  “Any participant can object by typing the “opt out” command. Sally then leaves the meeting and all data captured up to that point is permanently deleted.”

• Access control Report an error

  “Only authorized users within your organization have access to the meeting data. We use encryption and role-based access controls to ensure that your data is protected.”

• Third party sharing Report an error

  “No. We do not pass your data on and we do not use it for our own purposes. To run the service we rely on a fixed, documented list of subprocessors, all with infrastructure in the EU and all contractually bound.”

• Retention Report an error

  “There is no fixed default retention period: you define rules per workspace for the automatic deletion of transcripts, recordings and summaries, and you can delete individual meetings yourself at any time. After the contract ends we delete all data within 30 days.”

• Meeting notice Report an error

  “Sally automatically informs participants at the start of the meeting that she is present by sending a message in the chat.”

• Hours Report an error

  “Mon to Fri, 9:00 am to 4:00 pm”

• Entity Report an error

  “© 2026 Aliru GmbH. All rights reserved.”

• Location Report an error

  “Made with ❤️ in Mannheim, Germany”

Scores citing this record

• The Management Consultant Consent, participant rights & works council
• The Management Consultant Retention, AI training & administration
• The Management Consultant European sovereignty
• The Data Protection Officer Consent, participant rights & works council
• The Data Protection Officer Retention, AI training & administration
• The Data Protection Officer European sovereignty
• The IT Lead Consent, participant rights & works council
• The IT Lead Retention, AI training & administration
• The IT Lead European sovereignty
• The Sales Team Lead Consent, participant rights & works council
• The Sales Team Lead Retention, AI training & administration
• The Sales Team Lead European sovereignty
• The Skeptic Consent, participant rights & works council
• The Skeptic Retention, AI training & administration
• The Skeptic European sovereignty
• The Works Council Chair Consent, participant rights & works council
• The Works Council Chair Retention, AI training & administration
• The Works Council Chair European sovereignty