Security & Compliance
Powerful AI workflows. Human control where it matters.
Explore the policies, data processing terms and safeguards behind Travatar. Review checkpoints help teams control consequential website changes when approval is required.
Security & data protection
Overview
Security and compliance, clearly explained.
A clear overview of our privacy information, processing terms, data handling practices and security controls, with the document behind each one.
| Area | Status | What it covers | Documentation |
|---|---|---|---|
| GDPR & data protection | Published | Which personal data we process, why, on what legal basis and for how long, and when we act as controller or as processor. | Privacy Policy |
| Data Processing Agreement | Part of the Terms | Processing on your behalf, confidentiality, subprocessor obligations, breach notification without undue delay, and deletion or return when the services end. | Terms, Annex 1 |
| International transfers | Described in our policy | Data sent outside the EEA, for example to AI or infrastructure providers, relies on an adequacy decision or standard contractual clauses. | Privacy Policy |
| Access & security controls | Explained below | Access to personal data limited to the staff and providers who need it, with access controls and role-based restrictions among the measures, and logs that support investigation. | Our approach |
| Security documentation & reviews | On request | Information showing how we meet the DPA, provided when you ask for it. Where the law requires it, the DPA also allows one audit a year with 30 days' notice. | What you can request |
Operational security
Security is built into the way work moves forward.
Three rules shape how Travatar handles your work and your data.
Access limited to those who need it
Travatar works to limit access to personal data to the staff and service providers who need it to run, support and secure the service.
Access controls and role-based restrictions are among the measures our Privacy Policy describes.
A person approves consequential changes
Where a workflow requires approval, your team decides which prepared changes go live.
Approval rules depend on the action and its configuration.
Logs that support investigation
Our Privacy Policy describes the application, security and conversation logs Travatar uses to run the service, troubleshoot problems and investigate suspicious activity.
Kept to operate and secure the service.
Human control
AI prepares the work. Your team approves what matters.
Where a workflow requires approval, a person reviews the prepared change before it runs.
01
Observe
Identify a signal or opportunity
02
Prepare
Create a proposed next action
03
Review when required
Apply the workflow's approval rules
04
Execute within scope
Proceed under the applicable authorization
Approval requirements depend on the action type and configuration. Not every action requires review.
Explore the AI Growth CoworkerPrivacy & data protection
Clear information about your data.
Our privacy documents are public. For anything specific to your setup, write to our privacy team.
Public documents
Questions about your setup
Write to us about processing on your behalf, data subject requests or your organization's data protection questions.
Email [email protected]Data handling
How data moves through Travatar.
Each part of a workflow has its own role. The providers involved depend on the features and integrations you turn on.
- Your sideYour dataWebsite, account and the integrations you connect
- TravatarTravatarThe application and its workflow and approval rules
- Under contractService providersHosting, AI model and integration providers, under contract
- Your sideYour teamChanges to approve and reports to read
What data is involved?
It depends on the features you use. Data from third-party integrations is processed only to the extent you enable, connect or authorize them.
Who processes it?
Travatar, and hosting, AI model and other providers acting on our behalf under contract. The DPA binds subprocessors to protection no weaker than its own.
Where can it be processed?
Some providers may process data outside the EEA. Those transfers rely on an adequacy decision or standard contractual clauses.
For security, IT & procurement
Security information your team can review.
Start with the public documents, ask for what your review needs, and tell us about your setup.
02
Additional information on request
Under the DPA, you can request the information needed to show we meet it.
- Information on how we meet the DPA
- The providers relevant to your review
- An audit, where the law requires it
03
Discuss your requirements
Data processing, integrations, where data is processed and your supplier review questions.
Send us your questionsSecurity contact
Found a security issue? Tell us.
If you believe you have found a security issue affecting Travatar, contact us through our contact page.
Contact Travatar about a security issue- Include
- The affected feature, what you observed and a safe way to reproduce it.
- Do not send
- Passwords, access tokens or other people's personal data.
Frequently asked questions
Security questions, answered.
Data & privacy
Yes. The Data Processing Agreement is Annex 1 to our Terms of Service. It applies from the start of the services where data protection law requires it.
It depends on the service, the integrations you enable and the providers involved. Some providers may process data outside the EEA, and those transfers rely on an adequacy decision or standard contractual clauses. We can go through the arrangements for your planned use.
Yes. Some AI-enabled features send the inputs a task needs to AI model, inference or conversational technology providers. Which provider is involved depends on the feature and its configuration.
Our Privacy Policy lists the purposes for which we process data in AI features: providing them, keeping conversation history and memory, security, support and improving usability. The terms of the AI providers involved depend on the features in use, and we can take you through them.
Our Privacy Policy sets out which personal data we process, why, on what legal basis and for how long. Travatar is the controller for its own operations and generally a processor when it handles data on your behalf, under the DPA.
Categories include hosting and cloud infrastructure, AI model and inference providers, analytics, payments, authentication, email and support tools, and the integrations you connect. The DPA binds subprocessors to protection no weaker than its own. Ask us for the providers relevant to your review.
Use our data deletion page or write to [email protected] with your account details. When the services end, we delete or return the data processed under the DPA, at your choice, unless the law requires us to keep it.
Security & AI controls
No. Approval depends on the workflow and the type of action. Changes the Coworker prepares for publishing, such as content updates, wait for your team's approval; other authorized steps can run without one.
Travatar works to limit access to personal data to the staff and service providers who need it to run, support and secure the service. Access controls and role-based restrictions are among the measures our Privacy Policy describes.
Where the law requires it and the information we provide is not enough, the DPA allows one audit a year with at least 30 days' written notice, during business hours. We start with the information you request.
Yes. Under the DPA you can request the information needed to show we meet it. Send us your questionnaire or a list of the documents you need, and we will confirm what we can share and on what terms.
Use our contact page. Describe the affected feature, what you observed and a safe way to reproduce it, and do not include passwords, access tokens or other people's personal data.
Let's make your security review straightforward.
Tell us what your team needs to review. We will point you to the right information and the next steps.