Privacy, security & terms

Traffic to and from https://voltaire.events is protected with TLS (HTTPS), including HSTS where configured on our hosting. Data stored in our managed database and object storage is encrypted at rest by our EU-region infrastructure providers (for example Nhost / underlying cloud encryption). Application caches in the browser (such as local workspace cache) are not end-to-end encrypted; treat shared devices carefully.

• We do not use your event content to train our own machine-learning models.
• When we send content to third-party AI providers to generate transcripts, summaries, or slides, we configure those services — where the contract and product settings allow — so customer content is not used to train their public models.
• Processing is scoped to fulfilling your request in your project. We do not intentionally expose one customer’s confidential content in another customer’s results.
• You remain responsible for only uploading or streaming content you are allowed to process.

Details on categories of providers are in the Privacy tab.

Primary application runtime is hosted in the European Economic Area via Sliplane (German company) on European infrastructure (Hetzner DE/FI). Database, authentication, and related storage are provided by Nhost with an EU data region (currently eu-central-1). GDPR therefore applies to how we and our EEA processors handle stored project data.

Some delivery or AI components may still involve non-EU providers at the network or API layer. We are working toward a clearer EU-sovereign stack. We do not claim “data never leaves the EU” for every request (for example AI inference or edge delivery).

• Access to production systems and databases is limited to authorised VoltAIre / BaseGSA personnel on a need-to-know basis.
• We use strong authentication for administrative access, including multi-factor authentication (MFA) where available on the tools we use.
• Customer project content is not routinely reviewed by staff. We may access content only when needed for technical support at your request, to secure the platform, or to meet a legal obligation.
• In-product access to projects is tied to authenticated user accounts and database permissions (row-level / role-based controls via our backend).

• Authenticated API routes enforce user checks, rate limits, and input validation where implemented.
• Security-related HTTP headers are configured in the web application.
• Dependency and typecheck audits run in CI on a recurring schedule.
• Audience poll answers are stored separately from the main project document to reduce load and limit accidental bulk exposure patterns.

If a security incident or personal data breach occurs, we follow an internal response process: contain the issue, assess risk, and document decisions. We will inform affected customers without undue delay where there is a high risk to individuals, and we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) when GDPR requires it (in principle within 72 hours of becoming aware of a notifiable breach).

Report suspected vulnerabilities or incidents to privacy@voltaire.events.

• Keep account credentials confidential and use a unique, strong password.
• Only invite people who should see a project; Live vote links can be used by anyone who receives the URL.
• Inform speakers and attendees when sessions are recorded or transcribed, as required by your organisation.
• Review AI-generated output before publishing or distributing it.

Privacy and security questions: privacy@voltaire.events.