Privacy
You record your processes, roles and risks with us. This page says what we do with that data, what we keep and for how long, and which other parties play a part.
Last updated: 1 November 2026.
Who is responsible for what
Proceshuis is a product of aipox. For the data your organisation records in Proceshuis, your organisation is the controller and we are the processor: we process it only to provide the service, never for our own purposes, and we do not sell or share it.
For our own administration (contracts, invoices, contact with customers) and for this website, we are the controller ourselves.
Which data, and for how long
Your account
Your name, your e-mail address, your organisations and your role in each. You sign in with a code we e-mail to that address; there is no password. A guest account for the public example is removed after 7 days.
Your organisation's process house
Processes, RASCI, risks, controls, KPIs, work instructions and master data. These may contain names of functions or staff; your organisation decides that. This data stays for as long as your organisation keeps it.
The activity log
Who changed what and when in the process house and in members and roles. The log is kept for 12 calendar months and then deleted automatically.
Technical logs
To fix problems we log the path, the time and a request number of each request. These logs hold no IP addresses and no search terms.
This website
No cookies, no tracking and no requests to other parties: even the font is on our own server.
Sub-processors
These are all the parties that process data from Proceshuis on our behalf. There are deliberately few.
| Party | For what | Which data | Where | When |
|---|---|---|---|---|
| Own hosting | The app, the database and the backups run on a server we manage ourselves; there is no cloud provider in between. | All of the app's data | The Netherlands: our own servers in 's-Gravenzande (Westland), with an encrypted backup copy at a second location in the Netherlands | Always |
| Resend | Sending e-mail: sign-in codes, invitations and confirmation codes. | The recipient's e-mail address and the content of that e-mail | EU (Ireland) | Always; without e-mail nobody can sign in |
| The AI provider your organisation chooses (currently Anthropic) | The AI features, such as the activity check and the APQC suggestions. | The text you send with that feature, such as the names and descriptions of processes | Under the provider's terms; with Anthropic this may be outside the EU | Only when an owner of your organisation turns AI on with its own key. Your organisation then has its own agreement with that provider. With AI off, nothing is sent. |
When a sub-processor is added or changes, we put it on this page and in "What's new" in the app first, before that party receives any data. Objections or questions? E-mail info@proceshuis.com.
Security, backups and data breaches
How we secure and test the app is on the Security page.
We make a backup at least every 4 hours, so a failure loses at most the last 4 hours of changes, and we restore the service within 4 hours. Each backup holds the database as it was at that moment. We keep backups for at most 6 months: on our own servers one a day for 14 days, one a week for 8 weeks and one a month for 3 months, and the encrypted copy at the second location keeps one a month for 6 months. After that they are deleted.
If we find a data breach that affects your organisation's data, we report it to your organisation as soon as possible, with what we know and what we are doing. Your organisation then decides whether the breach must be reported to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens); we help with that.
Your rights
Want to see, correct or delete your data? For data in your organisation's process house, ask your organisation; it can do so itself in Proceshuis, and we help it. For our own administration, e-mail info@proceshuis.com.
If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).