Trust & Security

Last updated 2026-09-10.

DramaLabs is built for European companies that need an AI teammate without giving up control of their data. This page is the short version of how we handle it. The full detail is in our Privacy Policy. We will sign a Data Processing Agreement with you before you send us production data — ask and we will send ours, or we will review yours.

Hosting & data residency

Our core application’s account, company brain, conversation and run-output records are stored and processed in the EU: the API and the database run on Hetzner infrastructure in Germany, and the web dashboard (app.dramalabs.co) is served by Vercel from its Frankfurt region. Vercel’s network terminates your connection at the node nearest to you and forwards it to Frankfurt; for a visitor outside the EU that node is outside the EU. Nothing is stored there, and our API’s data at rest stays in Germany. This describes our application hosting, not copies held by messaging providers below. The controller is Practible AI UG (haftungsbeschränkt), Hamburg, Germany.

AI inference & international transfers

Nisa’s reasoning runs on large language models from OpenAI. To generate a response, the relevant prompt context is sent to OpenAI, whose inference endpoints are in the US. We send only what a given task needs, and everything Nisa drafts for you arrives as an approval card before it is sent (below).

Anthropic, Perplexity, OpenAI and Googleare used for one narrow purpose only: measuring whether your brand is recommended by AI answer engines. What we send them is a generated buyer-intent search query — for example “best CRM for small agencies” — which deliberately does not contain your brand name, so we can see whether it surfaces unprompted. No conversation content, no company brain, no personal data.

We are completing the data-processing agreements for these providers. Until they are in place we do not claim a transfer mechanism we cannot show you.

Your content is not used to train AI models

Under OpenAI’s and Anthropic’s API terms, content sent through their APIs is not used to train their models, and that is our contractual position. Your company data trains nobody’s model — not theirs, not ours. (Providers may retain request data transiently for abuse-monitoring under their own terms; we do not enable any use of your content for model improvement.)

Approval-first: a human is always in the loop

This is the core of how DramaLabs is built. Every outbound or irreversible action — an email, an outreach message, a published page, any external write — routes through an approval card in Slack. Nisa drafts; a person clicks Approve. Nothing is sent, and nothing irreversible happens, on the AI’s own initiative. This is enforced in code, not just policy.

Encryption & access

The API keys and tokens you connect are encrypted at rest. Traffic is served over TLS. Each tenant’s data is isolated; a workspace can only ever see its own workers, brain and connections.

Sub-processors

The service relies on these processors. We tell you before adding a new one.

  • Hetzner (Germany, EU) — API + data hosting.
  • Vercel(US company; our application runs in its Frankfurt, EU region) — hosting of the web dashboard at app.dramalabs.co, listed on 2 September 2026, the day it went live there. It holds no database and no backups; it serves the application and forwards your requests to our API in Germany. Its global network terminates connections at the node nearest the visitor, so a request from outside the EU passes through a node outside the EU on its way to Frankfurt.
  • OpenAI (US) — AI model inference for Nisa’s reasoning.
  • Anthropic, Google(US) — queried only to measure whether your brand is recommended by AI answer engines; they receive a generated search query, not your content.
  • Slack (US) — the surface Nisa lives in; messages in and out.
  • Photon and Apple— the optional iMessage path, disabled by default. Where enabled, Photon connects Nisa to Apple’s iMessage service and processes message content, recipient identifiers, attachments and delivery metadata. Photon-managed SMS/MMS/RCS fallback is allowed to the same recipient where supported; it does not authorize another recipient or additional messages. Carriers and other messaging providers involved in fallback may also process this content and metadata. We do not guarantee iMessage-only delivery. For this path we do not claim EU-only processing, a signed data-processing agreement, or end-to-end encryption through Nisa: the integration and assistant must process readable content. Provider retention and transfer safeguards remain to be verified; our EU hosting statement does not describe provider-held copies.
  • Microsoft(US / Global) — a second surface Nisa can live in; messages in and out pass through Microsoft’s Bot Connector. Listed here on 19 August 2026, the day the Teams connector was switched on, because this page promises to name a processor before it holds your data. The bot resource is currently registered with globalresidency, so this leg of the path is routed on Microsoft’s worldwide infrastructure and is notEU-only. An EU-regional resource is not selectable for us today — the West Europe region is blocked at Azure tenant level — and we would rather say so than imply a European route we do not have. Your data at rest stays in Germany (Hetzner); it is the message routing for this one surface that leaves the EU.
  • E2B (US) — isolated microVM sandboxes for running task code.
  • Backblaze B2(EU Central, Amsterdam) — off-site database backups. A full backup runs hourly, so this processor holds a complete copy of your data at rest.
  • Resend(US) — delivery of the transactional email we send on your behalf: recipient addresses and message content.
  • Composioand other connectors — only the tools you explicitly authorize, only the content those tasks need.

Your rights & your data

You can export your data and delete your accountand its data at any time — deletion cascades across your tenant. To exercise any GDPR right (access, rectification, erasure, portability, objection), email privacy@dramalabs.co. See Data deletion for the deletion path.

AI transparency

Nisa is clearly an AI assistant, never presented as a human, and her drafted output is shown as AI-generated for you to review before anything is sent — consistent with the EU AI Act’s Article 50 transparency expectations.

Contact

Security or data-protection question, or want the DPA? Email privacy@dramalabs.co. See also our Privacy Policy and Terms.