Scope and roles
The client is the controller; The Next Wilson B.V. is the processor. Client data remains the property of the client. Processing is governed by the data processing agreement.
For IT and privacy specialists
How our security is arranged
Technical and legal explanation for IT managers, privacy officers and security specialists. In case of conflict, the data processing agreement and the other legal documents prevail.
Version 20 October 2026 · Are you a user? Read the frequently asked questions about security
Where data is stored
Production is set up in the European Union.
| Function | Location |
|---|---|
| Application hosting | Frankfurt |
| API hosting | Frankfurt |
| Database and files | EMEA |
| AI inference and document recognition | EU |
| Transcription | EU |
AI processing
By default, AI runs through an EU setup: language models and document recognition (OCR and layout) with inference in the EU. Client data is not used to train the underlying AI models of third parties. Prompts and output at the AI provider are kept as briefly as possible, for a maximum of 30 days.
At the client's request we can also run AI through other models and providers, inside and outside the EU. Additional sub-processors and transfers may then apply, in line with the data processing agreement.
Transcription
Audio transcription runs in the EU. Audio is sent for conversion and the result returns to the platform. Names and other details mentioned in the conversation may appear in the transcript.
Isolation, access and authentication
Client environments are logically separated. Within an organisation, role-based access and case-file authorisation at user level apply.
Multi-factor authentication (email code or authenticator app) can be set per organisation. The client's administrator decides whether and for whom it applies.
Encryption, logging and changes
Data is encrypted in transit (TLS) and at rest. Audit logging is in place at platform level, on documents and on chat; logs serve accountability and security. Production changes require review by a second person.
Retention
During the agreement, data stays in the client's environment, within the retention periods the client sets in the service. The client remains responsible for GDPR retention towards its own clients.
After the agreement ends, the client has 30 days to request an export. The Next Wilson then deletes the data. Remnants in database backups disappear within the seven-day backup retention.
AI decision-making
AI output is supportive. The professional decides.
Testing and vulnerabilities
An external penetration test has been carried out; a summary is available on request, under confidentiality. Minimum frequency: internal at least twice a year, external at least once a year, supplemented by continuous vulnerability scanning. Remediation times are set by severity in policy.
We are working towards ISO 27001 certification. It is in preparation; we expect the certificate in Q4 2026.
Incidents
The Next Wilson reports data breaches and security incidents to the controller within 24 hours of discovery at the latest, via privacy@thenextwilson.ai. A first report may be provisional and will be supplemented.
(Sub-)processors
For the production service we use, among others: application hosting, API hosting, database and file storage, AI inference and document recognition, and speech-to-text, all in the EU. At the client's request, additional AI providers can be used, inside and outside the EU.
The current list of names, the grounds for transfer (including standard contractual clauses where applicable) and the change procedure are set out in the data processing agreement. We announce changes of sub-processors in advance; the client can raise a reasoned objection.
What the client does
- Have a professional check AI output before it is used.
- Inform participants when recording and determine the legal basis towards those involved.
- Switch on multi-factor authentication if your organisation's risk profile requires it.
- Make specific contractual agreements before processing special categories of personal data.
- Request an export within 30 days after the agreement ends if you want to keep data.
Questions we often get
How is tenant isolation set up?
Logical separation per client environment, plus role and case-file authorisation within the organisation.
How does standard AI processing work?
Language models and document recognition through an EU setup. The current (sub-)processors are listed in the data processing agreement.
How do you handle model training on client data?
Client data is not used to train the underlying AI models of third parties.
Where are files stored?
In European storage (EMEA). The current (sub-)processor is listed in the data processing agreement.
Which MFA is available?
Email code or authenticator app, set per organisation. The administrator decides whether and for whom it applies.
Which encryption is used?
TLS in transit and encryption at rest.
What is the retention after the agreement ends?
A 30-day export window, then deletion of the data. Backup remnants disappear within seven days.
What is in a transcript?
Names and other details mentioned in the conversation may appear in the transcript.
Which penetration test was carried out?
An external penetration test. A summary is available on request, under confidentiality.
What is the data breach notification period?
Within 24 hours of discovery by The Next Wilson at the latest.
What is the status of ISO 27001?
Certification is in preparation. The certificate is expected in Q4 2026.
Can health information be processed?
On the basis of specific contractual agreements.
Additional information on request
Additional specifications, the current list of sub-processors, a summary of the external penetration test and the data processing agreement are available on request, under confidentiality or under contract.