Security and data

Straight answers about data.

Where data is kept, who makes the decisions and how you can check the agents' work. And what is not in place yet.

Today Hörsam holds only made-up and public data. Real personal data is not accepted until the agreements are in place.

Where data is kept

Stored in the EU: The app runs in Frankfurt and the database is in Frankfurt. Files and jobs run in Stockholm.
Encrypted files: Files are stored encrypted, with no public access. They only travel over encrypted connections.
The AI models: The agents use Claude models from Anthropic. Calls go directly to Anthropic, outside our EU storage.

Two-step sign-in: Staff sign in with a password and a code from an authenticator app. Nobody can create an account on their own.
Each organisation apart: Permissions are checked on the server for every action. If you are not a member, you do not see the project.
Your data: An administrator can download all of the organisation's data as a zip file.

Never “met”: The agent never says a requirement is met. It shows what it found and where.
Decisions are not overwritten: Every decision is saved with a name and a time. A row is never changed. An undone decision becomes a new row.
Marked until tested: Anything that has not passed a blind test is marked “AI-assisted, not validated”.

Page and quote: Every claim has a file, page and quote, or a clear statement that nothing was found.
Quotes are checked: Every quote is compared with the page it cites, and once more before a report is approved.
Careful with “missing”: Before the agent says something is missing, it searches for other forms of the words. If it finds something, it says “possible support, check the page”.

Numbers, not names: In the case officer's view and in the report, a response appears under a number, not a name.
No identity numbers in plain text: Personal identity numbers are only stored in a form that cannot be read back.
Identification stays put: Name and identity number from identification are never sent to the AI model.

Screenshot from Hörsam, Swedish interface. Demo project with made-up data.

We are a small, early-stage company. This is missing today, and we would rather say so ourselves.

No certification, such as ISO 27001 or SOC 2.
No penetration test and no third-party audit.
No promise that the AI models process data inside the EU, and no Swedish or European AI provider.
The data processing agreement is a draft. No sub-processor agreements are signed.
No BankID connection. Resident identification is simulated in the demo.
No sign-in through your organisation's own identity provider.
No uptime monitoring and no availability agreement.

Write to us. We answer what we can and say so when we do not know.