Security, privacy, and control

Before AI can use company documents or update a business system, your security team needs clear answers. Where is the data processed? Which users can see each document? Can a model provider train on it? What happens when the system changes a record?

This page explains Opero’s standard approach. Contract terms and the data-processing agreement define the exact setup for each customer.

Where data is processed

Opero is hosted on infrastructure in the European Union by default. Customer documents, search indexes, conversation history, and account information are kept within the agreed hosting region.

AI model requests use EU endpoints by default where the selected provider supports them. If your agreement requires EU-only processing, routing is restricted accordingly. If you require one country, a private environment, or an installation within your own infrastructure, that can be agreed before deployment.

The providers and services used for your deployment are listed in the applicable subprocessor information and data-processing agreement.

Your data is not used to train models

Opero does not use customer documents, conversations, or business records to train models.

When a user asks a question, Opero finds the permitted information needed for that request and sends the relevant context to the selected model. The material is used to prepare that response; it is not added to a shared Opero training collection.

Customer environments remain separate. One customer’s documents and conversation history are not used to answer another customer’s questions.

Users only receive information they may access

Opero applies user and document permissions before information is sent to an AI model. If an employee cannot open a restricted SharePoint file, Opero does not use that file to answer their question.

Permissions can be based on role, team, customer, project, product, or individual document. Connecting another source does not automatically give users wider access; it makes their existing permitted information searchable.

Reading and changing data are separate permissions

Read access is the default. Permission to create or update a record is granted separately for each connected system and action.

For example, Opero may be allowed to read a warranty record and prepare a service case but require a person to approve a purchase order or customer message. Actions involving money, safety, legal terms, or customer commitments can always pause for named approval.

What the activity record contains

Opero records questions, sources used, model versions, workflow steps, changes to connected systems, and human approvals or rejections. Records are separated by customer and include the user and time.

This lets an authorised reviewer investigate a specific answer or action later. Retention periods are set according to the customer agreement and applicable requirements.

Model choice

Opero can use models from providers including Anthropic, OpenAI, and Google. The models available to your users are configured for your environment.

If your security policy excludes a provider, it can be disabled. Different tasks may use different approved models, and the model version used for an answer is included in the activity record.

Connections to your existing systems

Opero can connect to document stores, ERP and CRM systems, service tools, email, and communication platforms. The original system remains responsible for its records; Opero does not require a full data migration.

Connections inherit the access rules agreed for that source. Actions that update another system are limited to the permissions granted for that connection and are recorded.

See the current examples at Integrations.

Retention and deletion

Retention periods can be configured in the customer agreement. Data is removed according to that schedule and the agreed deletion process.

Every plan supports data export. Requirements for a private deployment, customer-managed infrastructure, or a specific regional boundary should be agreed before implementation.

Certifications and subprocessors

Opero provides data-processing documentation and current subprocessor information during security review. Opero is designed to support GDPR obligations. A SOC 2 Type II audit is in progress; it should not be treated as completed certification until the final report is available.

Contact us for the current subprocessor list, security questionnaire, or contract-specific documentation.

Where to look next

• Knowledge Agent — see how cited answers and document permissions work for users.
• Integrations — see how read and update permissions apply to connected systems.
• Building a knowledge agent technicians trust — learn how sources and review affect day-to-day use.
• EU-hosted AI and procurement — prepare for data and security questions during procurement.