No. Alfred is built on Azure AI Foundry, where the underlying models are stateless. Your prompts and the responses Alfred generates are never used to train, retrain, or improve any AI models – whether Mitigram’s, Microsoft’s, or any third party’s. This is contractually guaranteed under Microsoft’s Product Terms and Data Protection Addendum.

All data stays within the European Union. Alfred runs entirely inside Mitigram’s Azure tenant in EU data centres (West Europe / North Europe). Prompts, responses, and any related data are processed and stored in the same EU geography – supporting GDPR compliance and EU data sovereignty requirements.

No. Alfred operates entirely within the Azure service boundary on Mitigram’s tenant. Your data is never sent to model providers, third parties, or external servers. Microsoft hosts all AI platform components on its own infrastructure with no runtime connections to outside model providers.

Yes. Alfred is designed for GDPR compliance from the ground up:

• No personal data is used for model training
• All processing takes place within the EU
• Microsoft acts as data processor under its DPA, including Standard Contractual Clauses
• Mitigram’s own DPA with you covers all processing performed by Alfred
• Users only interact with Alfred on data they are already authorised to access

No new categories of personal data are collected, and data minimisation principles apply throughout.

Yes. Mitigram AB holds current ISO 27001:2022 certification, audited by DNV. Our Information Security Management System covers all operations, including the development and delivery of Alfred. AI-specific risks have been formally incorporated into our risk assessment and security controls.

Yes. All data is encrypted in transit and at rest using industry-standard encryption. Microsoft provides default encryption for all stored data, and customers with stricter compliance requirements can opt for customer-managed encryption keys for an additional layer of control.

No. Alfred is opt-in only. It is never enabled by default, and Mitigram will never activate Alfred for any customer without an explicit request from an authorised representative. This gives you the time and space to complete your own internal assessments before going live.

The underlying AI models are stateless – they retain nothing after processing your request. Any conversation history visible to you within the Mitigram platform is stored inside Mitigram’s own Azure environment and governed by the same data retention policies that apply to the rest of your platform data.

Yes. The introduction of Alfred has been assessed as part of Mitigram’s ISMS risk management process. The assessment covers data privacy, model reliability, access control, and regulatory requirements, including application-level concerns such as prompt injection, data leakage, output accuracy, and access control. Each identified risk has corresponding mitigation controls in place.

For detailed compliance, DPIA support, sub-processor information, or contractual questions related to Alfred, our Legal & Compliance team is available to schedule a deep-dive call. Reach out to your Mitigram contact and we’ll arrange a session with the right experts.