# General Information about Workist

## Does the EU Artificial Intelligence Act affect Workist and companies using Workist?

The AI we use is part of a process automation software that automatically captures, extracts, and forwards data fields from transaction documents. It is classified as an "AI system with no risk or limited risk".

Following Article 50 of the AI Regulation, users can see which data is read out by AI.

---

## Information Security and Data Protection at Workist

Workist operates a **SOC2 Type II** audited ISMS. All productive systems are located exclusively in the EU/EEA. The only exception are voice agents that run in ElevenLabs' global environment at your request (see [Voice agents](#sprachagenten)). A GDPR-compliant DPA is in place.

### Storage Location and EU Exclusivity

- Exclusively in data centers within the EU/EEA
- Cloud providers: AWS (Ireland/Frankfurt) and Microsoft Azure (West Europe, North Europe, Germany West Central, Sweden Central)
- Sub-processors are listed in the DPA Annex IV

### Voice Agents {#sprachagenten}

For [voice agents](/en/docs/agents/voice-agents.md), Workist also uses these providers:

- **ElevenLabs** for speech recognition and speech output. By default, every voice agent runs in ElevenLabs' EU environment.
- **Twilio** for telephony. Calls are processed in Ireland.

At your request, Workist switches a voice agent to ElevenLabs' global environment. From then on, that voice agent's call data is also processed outside the EU. You cannot change this setting yourself.

### Storage Duration

- Transient data is discarded after processing
- Structured extraction results, manual corrections, and original documents are stored for the duration of the contract
- On request, Workist agrees a shorter retention period in days with you. Workist then deletes every day all documents older than this period, together with the original file, email, extraction results, corrections and generated output files. This also applies to emails from the Smart Inbox and to older master data import files.
- After contract termination: Workist deactivates all user accounts and deletes all data 30 days later

### Transmission and Protection

- TLS 1.2+ for transmission
- AES-256 for storage
- Logical tenant separation, role-based access controls, audit logs

### Processing at Multiple Locations

- Cross-zone replication and geo-redundant backups within EU regions

### Accuracy of Results (Quality Assurance)

- Automated validation against customer catalogs/plausibility rules
- Confidence score threshold system
- Manual review via Workist Workbench when the threshold is not met