Trust Center
How we handle data, security and AI.
What we do with your data, where it is processed, the rules our team and our AI agents follow, and the public commitments we are making.
DraftThis page is a draft. Lists marked “before launch” are being completed and reviewed by a lawyer.
Data protection
GDPR by default.
We collect only what we need to answer you and to deliver the work.
Minimal forms
The project brief asks only for what we need to reply. Requests go to hello@t-matrix.net.No tracking cookies
This website sets no advertising or tracking cookies. It keeps one setting in your browser for the session: whether you have seen the intro.Your rights
Access, correction, deletion and objection. Write to hello@t-matrix.net and we reply within one business day.Learn moreProcessing agreements
For client projects and our products we sign a data processing agreement (DPA / AVV) under GDPR Art. 28.
Where data is processed
EU first.
We prefer services that process data in the EU. Where a service is outside the EU, we name it and the legal basis for the transfer.
| What | Where |
|---|---|
| HyperSale AI features | OpenAI API, EU data processing endpoint. Your own company name and website are masked before each AI call. |
| Website, e-mail, Stellwerk | Providers and regions are listed before launch. |
Security
Rules for people and agents.
Secrets stay secret
Passwords and keys never go into an AI tool, prompt or chat. Agents get scoped keys from the environment.Masking
Names, e-mails and IBANs become placeholders before data leaves for a cloud AI model (Stellwerk Mask).Human approval
Deploys, payments and outgoing mail by an agent wait for a person (Stellwerk Guard).Review before release
Code is reviewed by a second person, texts and media by the person responsible.
AI policy
What may go into which AI model.
Our AI policy sets these data classes for everyone who works for T-Matrix, people and agents. The full policy is being finalised and will be published here.
| Data | Examples | Allowed AI use |
|---|---|---|
| Public | Published texts, public company information | Any approved AI service |
| Internal | Internal notes, non-sensitive code, plans | Approved services under business terms, EU processing preferred |
| Client and personal data | Client documents and code, names, e-mails, phone numbers | Only under a data processing agreement, or after masking |
| Special data | Health data, data under professional secrecy | Only with written approval for the case, EU-hosted, always masked |
| Secrets | Passwords, API keys, tokens | Never sent to any AI model |
Masked data is still personal data under the GDPR, and we treat it that way. The policy also covers AI literacy training for the whole team (AI Act, Art. 4) and how we label AI-generated media.
Documents
Subprocessors and DPA.
Subprocessors
before launchThe full list of services that process data for us, with purpose and location.DPA / AVV
before launchOur data processing agreement for client projects and products, to download.
EU AI commitments
In progress: EU AI Pact and the Code of Practice.
We are preparing to join the EU AI Pact and to sign Section 2 of the EU Code of Practice on transparency of AI-generated content. Both are voluntary.
EU AI Pact
in progressThree core pledges: an AI governance strategy, a map of our AI systems with their risk class, and AI training for our team. Plus labelling of deepfakes and human oversight.Code of Practice, Section 2
in progressVisible labels on deepfakes from the first view, EU icons for AI-generated content and a log of what was labelled and how.
Once we appear on the official lists, we will say so here with a link to the European Commission's page, so you can check it yourself.