Scaffold · Data & security
Where your product data lives, and where it goes.
The short version: your strategy is stored in the EU, and the AI that drafts with you runs through providers in the US. Here is the longer version, including the parts that are not the simplest to say.
Stored in the EU
Your strategy map, the documents you upload and every backup sit on Produxity's own servers with Hetzner, in the EU. Documents you upload are read on those same servers, not handed to an outside service.
How: the database, the job queue and document extraction run in one EU deployment. The nightly backup goes to Hetzner Object Storage in Helsinki and covers the database. It does not cover the files you upload: those sit in the server's whole-machine backups, which restore a server, not a single file. Keep your own copy of anything you upload.
Processed by AI providers in the US
To draft an answer, Scaffold sends the relevant part of your strategy map to a model from Anthropic, OpenAI or Google, all three US companies. Council activities send it to all three at once, so that each can check the others.
Two other US services see some of your material: Exa runs web research, and OpenAI builds the search index across your strategy map.
Google runs on its paid tier, which is not used to train models. We are not making that promise for every provider yet: Exa may keep the search queries we send it until a zero-retention agreement is signed, so we say so rather than claim otherwise.
How: every generation goes through one code path, which also switches off OpenAI's option to store what we send.
Who handles what
| Who | Where | What they handle |
|---|---|---|
| Hetzner | EU | Hosting: your strategy map, the documents you upload, and backups |
| Anthropic, OpenAI, Google | US | Drafting answers, and council activities, which use all three |
| Exa | US | Web research, and fetching pages from the website you enter |
| OpenAI | US | The search index across your strategy map |
| Resend | US | Account and notification email |
What the free research run reads and sends
When you start, Scaffold reads the website address you enter: Exa, our research service, finds and fetches pages on that site only. Documents you upload are extracted on our own servers. That text goes to the AI providers to sort and draft, and research queries written from it go to Exa. A product's documents are deleted with the product.
The Scaffold Privacy Notice (a draft, pending legal review) describes this in full.
Your own API keys
Not yet availableNot available yet. When it is, your organisation can connect its own key for Anthropic, OpenAI or Google, so generation runs under a contract your company already holds, with a provider it has already cleared.
What it does not change: our servers still make the call, so your material still passes through Scaffold. Three things stay on our accounts: the search index (OpenAI), web research (Exa), and council activities, which call all three providers and so need all three of your keys.
Kept apart from everyone else's
Each organisation's data is separated inside the database itself, not only by the app, so a request made for one organisation cannot read another's. Before Scaffold first opened to users, the whole codebase went through an automated OWASP security audit, and all 35 confirmed findings were fixed.
No advertising, and no trackers in your browser
The Scaffold app carries no advertising and no trackers in your browser. Our servers send usage events to PostHog, a product analytics service hosted in the EU: counts and timings, never names, email addresses or content. If you accepted analytics cookies on this website, Scaffold also tells Google Analytics when you sign up, without your name or email. This website uses Google Analytics, which you can refuse in the cookie banner.
What not to put in
Two limits on what to put in: no special-category data, and no third-party material you are not free to share. The terms you accept when you sign up carry the detail.
Start with what your company already knows.
Everything above holds from your first day, except your own API keys, which come later.