Responsible AI.
Not promises — mechanisms.

We work with three families of language models. Model selection for each project depends on your sovereignty requirements, the use case, and required technical performance.

OLIXID acts as a data processor within the meaning of Article 4(8) GDPR for personal data processing carried out in the context of your projects. The data processing agreement is governed by Article 28. You remain the data controller.

Lawful basis

Processing is based on contract performance (Art. 6.1.b) and, for ancillary processing (service improvement, quality follow-up), on legitimate interest (Art. 6.1.f). No personal data from your end-users is used to train third-party AI models.

Data Processing Agreement (DPA)

A DPA compliant with Article 28 is available for signature for any project. It covers the categories of data processed and their purposes, technical and organisational security measures, deletion timelines, the list of sub-processors, and audit and incident-notification modalities.

Minimisation

In each project, we configure our systems to process only the data strictly necessary for the defined use case. Prompts sent to LLM APIs do not contain personally identifiable data unless technically necessary and documented. Pseudonymisation or anonymisation upstream is our standard practice for any RAG pipeline or AI agent handling sensitive data.

Retention

Project data (code, configurations, files): contract duration + 12 months, then deleted. LLM API call logs: depending on provider and contract; Anthropic API and Mistral API document retention up to 30 days, and Zero Data Retention options depend on provider offer and approval. Contact form data: 12 months maximum. Backups: deleted within 30 days of contract end.

Data subject rights

If your end-users exercise their rights (access, rectification, erasure, restriction of processing, portability, objection) with you as data controller, we provide technical assistance within 5 business days.

Transfers outside the EU

For processing involving a non-EU provider without EU residency enabled, transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission. These transfers are documented in the DPA.

What role does OLIXID play?

The AI Act distinguishes several actors. Depending on the project, OLIXID sits in one role or the other:

This distinction is documented contractually in each engagement.

Risk classification

The Act defines 4 risk levels. The vast majority of systems we build for SMEs fall in the "limited risk" or "minimal risk" category:

During diagnostic, we assess the risk level of each use case. If a system reaches the "high risk" threshold, we inform the client and adapt deliverables (documentation, audit trails, mandatory human oversight). AI systems embedded in regulated products, such as certain medical devices, follow a separate high-risk pathway (Art. 6(1) and Annex I).

Transparency and human oversight

• The end-user is informed they are interacting with an AI system (Art. 50).
• A human fallback is designed into each relevant project (AI proposes, human validates).
• High-stakes decisions (financial, HR, contractual) are never fully automated without explicit human validation.

Application timeline

This commitment is built into each RAG, document agent, or internal assistant project. It does not apply in the same way to creative generation systems or classification pipelines.

OLIXID is not ISO 27001 or SOC 2 certified. We apply a rigorous security baseline and discuss specific certifications if your project or sector requires them. What we concretely do:

Source code

Transferred via GitHub (repository assigned or PR merged into your organisation). You have access to the full code from the first sprint, not just at final delivery.

Fine-tuned models

Model weights trained on your data belong to you. They are stored in your cloud environment or transferred to your servers.

Training data

Data and annotations remain under your control. OLIXID only accesses them for the purpose of the project.

Secrets and credentials

All API keys and identifiers used for your infrastructure are transferred to you at the end of the project.

Open source licences

Where we integrate open-source libraries, we document applicable licences (MIT, Apache 2.0, etc.). No restrictively licensed library (GPL copyleft) is integrated without explicit client validation.

OLIXID may reference your project as a commercial reference (sector, use case type, generic result) — unless a specific NDA is in place.

Any new sub-processor is notified to affected clients with 30 days' notice.

Sub-processors marked "relevant projects" only process data for projects configured with their API. A project using only one provider or a self-hosted deployment sends no data to the other LLM providers.

Self-hosted software

These tools are operated by OLIXID on our infrastructure. Data is not transferred to the software publisher; the hosting sub-processor remains Hetzner.

This document is reviewed regularly, and systematically at every material change: new sub-processor, new LLM integrated into a project, regulatory update.

Two addresses, two answers within 2 business days:

Or by post: OLIXID SAS — 1 rue Marguerin — 75014 Paris, France

For CNIL complaints: www.cnil.fr