Security
The answers your procurement team asks for.
GAIA was built for UK government data, which sets the floor for every customer. This summary reflects the commitments in our data processing agreement.
Where your data goes
- All processing takes place in the European Economic Area, in Google Cloud's europe-west4 region in Amsterdam.
- No processing takes place in the United States.
- Transfers to the EEA are covered by the UK adequacy regulations, so no additional transfer safeguard is required.
- Two sub-processors only: Railway for application hosting, and Google Cloud for infrastructure and model inference. Both in europe-west4.
What happens to your documents
- Models run in inference-only mode. No customer or user data is used to train or fine-tune them.
- GAIA uses Anthropic's Claude models served through Google Cloud, so service data is not sent to Anthropic and Anthropic is not a sub-processor.
- No persistent store of uploaded documents or generated drafts in the trial environment.
- Deletion and return of data are covered in the data processing agreement.
How the service is isolated
- A separate deployment per customer, with no shared environment and no cross-customer access.
- Outbound traffic from the agent is restricted to an allowlist of approved domains.
- A password gate on every deployment, rate-limited by IP and locked out after five failed attempts in fifteen minutes.
- Session cookies are HTTP-only, HTTPS-restricted, and signed so they cannot be forged.
Operational controls
- Encryption in transit using TLS 1.2 or higher, and at rest by our hosting and infrastructure providers.
- Multi-factor authentication on all staff accounts with administrative access.
- Activity and audit logging shipped off the container, so records survive a restart or redeploy.
- No automated decision-making. GAIA produces drafts for review, and a person makes every decision.
The binding version
This page summarises. The GAIA trial privacy and security notice is the full document, covering lawful basis, retention, your rights, and breach handling.
Read the full noticeNeed the assurance pack?
We will complete your supplier questionnaire and share the data processing agreement before any document moves.