Skip to main content
Markdown

General Information about Workist

Does the EU Artificial Intelligence Act affect Workist and companies using Workist?​

The AI we use is part of a process automation software that automatically captures, extracts, and forwards data fields from transaction documents. It is classified as an "AI system with no risk or limited risk".

Following Article 50 of the AI Regulation, users can see which data is read out by AI.

Information Security and Data Protection at Workist​

Workist operates a SOC2 Type II audited ISMS. All productive systems are located exclusively in the EU/EEA. The only exception are voice agents that run in ElevenLabs' global environment at your request (see Voice agents). A GDPR-compliant DPA is in place.

Storage Location and EU Exclusivity​

  • Exclusively in data centers within the EU/EEA
  • Cloud providers: AWS (Ireland/Frankfurt) and Microsoft Azure (West Europe, North Europe, Germany West Central, Sweden Central)
  • Sub-processors are listed in the DPA Annex IV

Voice Agents​

For voice agents, Workist also uses these providers:

  • ElevenLabs for speech recognition and speech output. By default, every voice agent runs in ElevenLabs' EU environment.
  • Twilio for telephony. Calls are processed in Ireland.

At your request, Workist switches a voice agent to ElevenLabs' global environment. From then on, that voice agent's call data is also processed outside the EU. You cannot change this setting yourself.

Storage Duration​

  • Transient data is discarded after processing
  • Structured extraction results, manual corrections, and original documents are stored for the duration of the contract
  • On request, Workist agrees a shorter retention period in days with you. Workist then deletes every day all documents older than this period, together with the original file, email, extraction results, corrections and generated output files. This also applies to emails from the Smart Inbox and to older master data import files.
  • After contract termination: Workist deactivates all user accounts and deletes all data 30 days later

Transmission and Protection​

  • TLS 1.2+ for transmission
  • AES-256 for storage
  • Logical tenant separation, role-based access controls, audit logs

Processing at Multiple Locations​

  • Cross-zone replication and geo-redundant backups within EU regions

Accuracy of Results (Quality Assurance)​

  • Automated validation against customer catalogs/plausibility rules
  • Confidence score threshold system
  • Manual review via Workist Workbench when the threshold is not met