OPSQAIOQOPSQAI

Data Processing — Self-Hosted Deployment

OPSQAI is delivered as a Windows-native, self-hosted product. This page explains why the classic Art. 28 GDPR processor DPA does not describe the bulk of a customer's OPSQAI deployment, and what limited processing OPSQAI performs on opsqai.de. The counterpart signed contractual documents are available on request from notify@opsqai.de.

1. The self-hosted instance — customer premises

The OPSQAI application (Caddy, Platform, Worker, Portable PostgreSQL, Updater — each running as a native Windows service) is installed on the customer's own dedicated Windows Server. All customer content — uploaded documents, embeddings, chunks, questions and answers, end-user accounts, audit logs, object storage, database backups — resides in C:\ProgramData\OPSQAI\ (or an equivalent path chosen by the customer) on that server. Neither OPSQAI nor opsqai.de receives, stores, indexes, or otherwise accesses that content.

For that scope the customer acts as both controller and processor under its own security and IT governance policies. OPSQAI provides the software, documentation, and updates; it does not operate the instance and has no standing access to it. There is therefore no personal-data processing to describe under Art. 28 GDPR for the self-hosted instance.

2. AI provider — chosen by the customer

The customer selects and pays for the AI provider used by the self-hosted instance — OpenAI, Azure OpenAI, Ollama (local), OpenRouter or any OpenAI-compatible endpoint. API keys are entered into the first-run wizard and stored encrypted on the customer's own server. OPSQAI does not act as an intermediary and does not have access to those keys or to the traffic between the self-hosted instance and the chosen provider. Any DPA / SCC arrangement with the AI provider is between the customer and that provider directly.

3. Licence, updates and aggregate usage — the only outbound calls to OPSQAI

The instance periodically contacts the OPSQAI Management Center to validate the Ed25519-signed licence and to check for signed update packages (verified by SHA-256 and publisher signature before installation). If the customer leaves aggregate reporting enabled, the same channel carries counters such as number of questions, documents and active seats. These requests contain the installation and licence identifiers, software version, timestamp and counters only — no customer content, no end-user names or email addresses, no usage counters keyed to a person. Aggregate reporting can be disabled by the customer. This falls under legitimate interest (Art. 6(1)(f) GDPR) for licence enforcement, update integrity and service quality, not under Art. 28.

3a. Microsoft 365 integrations — the customer's own tenant

If the customer enables Microsoft sign-in (Entra ID), SharePoint synchronisation, Email Intelligence or the Teams bot, the instance connects directly to the customer's own Microsoft 365 tenant using an app registration the customer creates and controls. Content flows between the customer's tenant and the customer's server only; OPSQAI does not receive it. Email Intelligence only drafts replies — a person reviews and sends every email; OPSQAI never sends email on its own.

3b. Tools the software gives the controller

  • Access and portability (Art. 15, 20): administrators can export all data stored about one user as a machine-readable file, excluding passwords and secrets.
  • Erasure (Art. 17): administrators can anonymise a user — name, email and contact data are replaced by a pseudonymous code, the account is disabled and their AI conversations are deleted, while the activity log stays intact under the code.
  • Storage limitation (Art. 5(1)(e)): a configurable retention period automatically deletes AI chat history older than the chosen number of days.
  • Accountability (Art. 30, 32): an append-only activity log records exports, anonymisations, permission changes and administrative actions; access is role-based and checked on the server; sessions end after 30 minutes of inactivity.

4. opsqai.de and the Customer Portal — narrow Art. 28 scope

There is one context in which OPSQAI does process personal data on behalf of a customer: the Customer Portal, where designated customer contacts sign in to download the installer, retrieve their signed licence, and open support tickets. The limited processor role covers only:

  • Contact-account data (name, work email, role, company) of the designated contacts.
  • Support / contact-form correspondence.
  • Server access logs for those requests (IP, user-agent, timestamp — 14-day rolling retention).

A written Art. 28 addendum covering this narrow scope is available on request. Security measures for opsqai.de: TLS 1.2+ in transit, encryption at rest on the managed database, role-scoped access, MFA-protected admin access, and time-boxed access logs.

5. Subprocessors of opsqai.de

The marketing website and Customer Portal currently rely on:

  • STRATO AG (Germany) — domain, DNS and email hosting, including the mailbox used for contact and support correspondence.
  • Cloudflare, Inc. (USA / EU) — CDN, DDoS protection and TLS termination; processes request metadata only, under Standard Contractual Clauses and Cloudflare's EU Data Processing Addendum.
  • Lovable (EU) — application hosting platform for the website, Customer Portal and Management Center, including authentication and the managed database.

Customers on active agreements are notified in writing at least 30 days before any material change to this list. None of these subprocessors receive customer content processed by the self-hosted instance, because that content never leaves the customer's premises.

6. International transfers

Where a subprocessor of opsqai.de processes personal data outside the EEA, transfers are safeguarded by Standard Contractual Clauses under Art. 46 GDPR or an equivalent adequacy mechanism. This does not apply to AI providers — those are contracted directly by the customer.

7. Data subject rights and assistance

For data held on opsqai.de OPSQAI responds directly to data-subject requests. For data held inside a self-hosted instance the customer is responsible; OPSQAI provides documentation and reasonable technical assistance through the Customer Portal.

8. Return and deletion

  • Self-hosted instance: data is deleted by the customer on their own server (uninstall workflow removes the services and, at the customer's option, C:\ProgramData\OPSQAI\). OPSQAI has no data to return or delete.
  • opsqai.de: on termination of the customer agreement, Customer Portal accounts and associated correspondence are deleted within 30 days, except where a legal retention obligation applies. Server logs age out via the 14-day rolling window.

9. Certification status

OPSQAI is not currently SOC 2 or ISO/IEC 27001 certified. We rely on the certifications of the underlying managed hosting used by opsqai.de and on the security practices documented in the Security page and the Security Documentation. Certification of a hosting provider does not extend certification to OPSQAI itself.

For the current signed version or a written addendum tailored to your organisation, contact notify@opsqai.de.