How we protect your data
You trust us with your company's financial data, and we know exactly how much that trust weighs. Here is the short version of how we keep your data safe. The full detail is ready for your security and legal teams whenever they want it.
Your data does not leave the EU
Everything is stored and processed in Microsoft Azure data centres inside the European Economic Area. That includes all AI processing. Simple rule, no fine print.
ISO 27001 certified
Our information security management system is ISO 27001 certified and independently audited. We review it continuously, because a certificate is only worth something if you keep living up to it.
Locked down by default
All data is encrypted in transit. Access follows least privilege, with multi-factor authentication for everyone, including our own team.
Your data never trains AI
Your data is never used to train AI models and never touches public AI services. All AI runs inside our own Azure environment, and every AI action is logged, so you can always see what happened and why.
One sub-processor, no surprises
Exactly one: Microsoft Azure, for hosting and AI. If that ever changes, you hear it from us in writing 30 days in advance, with the right to object.
Certified and independently tested
ISO/IEC 27001:2022 certified since November 2024
Certificate NL24112903. The scope covers all our services, including the NineAnts platform. An external auditor checks it every year; the last surveillance audit was in November 2025.
Independent penetration tests, every year
Every year, a certified ethical hacker tests both the NineAnts application and the infrastructure it runs on.
Every AI action is logged
The Treasury AI Agent works with deterministic tools and records what it did and why, so your team and your auditors can always trace a result back.
The paperwork is ready when you are
Behind this page sits the full contractual framework your legal team will want to see:
- A GDPR Article 28 DPA with a dedicated AI annex, shared before you sign anything
- Breach notification within 72 hours
- On exit, your data is deleted or returned within 30 days
- Audit rights on reasonable notice
Security questions we often get
Where is NineAnts data stored and processed?
In Microsoft Azure data centres inside the European Economic Area. That includes all AI processing. Your data does not leave the EEA.
Is our data used to train AI models?
No. Your data is never used to train AI models and never goes to public AI services. All AI runs inside our own Azure environment, and every AI action is logged.
Which sub-processors does NineAnts use?
One: Microsoft Azure, for hosting and AI. If that ever changes, you hear it from us in writing 30 days in advance, with the right to object.
Is Automation Boutique ISO 27001 certified?
Yes. Automation Boutique B.V. is certified to ISO/IEC 27001:2022 (certificate NL24112903) since November 2024, and the scope includes the NineAnts platform. The certification is audited externally every year.
Do you run penetration tests?
Yes. Every year, independent penetration tests cover both the NineAnts application and its infrastructure.
What happens to our data when we stop using NineAnts?
Your data is deleted or returned within 30 days of the end of the contract. Breaches are reported to you within 72 hours, as set out in our Data Processing Agreement.
Questions from your security or legal review? We are happy to share the full Data Processing Agreement, including the AI annex, and walk through our set-up with your team.
Contact us or read the NineAnts privacy policy.