Trust and data protection
Where research data is stored, who processes it, and the documents your institution may ask for.
Last reviewed: 11 October 2026
Stored in the EU
Projects, transcripts and recordings are stored on DigitalOcean servers in Amsterdam, Netherlands, with backups in the same EU region.
You choose where AI runs
Global AI is the default. EU Assurance keeps AI processing within the EU, on every plan.
Not used to train AI
Qualitati does not use your research data to train AI models.
Export or delete at any time
Export transcripts and coded data as CSV, Word or REFI-QDA, and permanently delete interviews or whole projects yourself.
Where AI processing happens
Each account chooses one of two options in Profile. The choice applies from the next AI call and stays fixed until you change it.
Global AI
Your research data is stored in the EU. AI processing uses global providers, including providers in the United States.
EU Assurance — EU-only AI processing
Your research data is stored in the EU and AI processing stays within the EU. Available on every plan; uses more credits per task.
Audio transcription runs in the EU (Mistral Voxtral, France), and live voice interviews run on Amazon Nova within the EU when available — otherwise participants are offered the text interview.
Sub-processors
Data processing agreements are in place with each provider. The same list is part of the privacy policy, which is the reference if the two ever differ.
- DigitalOcean: Cloud hosting, storage, and hosted open-model inference (Gradient), Netherlands (EU)
- Google Cloud Speech: Speech-to-text transcription, EU processing region
- ElevenLabs: Speech-to-text transcription and AI interviewer voice for voice interviews, United States (SCCs)
- OpenAI: LLM inference for AI interviews, United States (SCCs)
- Anthropic: LLM inference for AI interviews, United States (SCCs)
- Google (Gemini): LLM inference for analysis tools, United States (SCCs)
- Amazon Web Services (Bedrock): EU-resident LLM inference for the EU-only AI processing option, European Union
- Mistral AI: EU-resident LLM inference for the EU-only AI processing option, France (EU)
- Scaleway: EU-resident LLM inference, France (EU)
- Xiaomi (MiMo): AI interviewer voice (text-to-speech) for Chinese-language interviews, China (contractual safeguards; never used for EU-only AI processing)
- Google Analytics: Website usage analytics, United States (SCCs)
Security measures
- Encryption in transit: All connections use HTTPS with TLS 1.2 or higher.
- Encryption at rest: AES-256 encryption at the storage layer. Database connections use SSL.
- Access control: Production systems are accessible only to authorised team members via SSH key authentication.
- Dependency management: Automated scanning for known vulnerabilities. Critical security patches applied within 48 hours.
- Credential storage: API keys and secrets are stored as environment variables, never in source code.
Retention and deletion
- Account data: Retained while your account is active. Deleted within 30 days of an account deletion request.
- Interview data: Retained while your account is active. You may export or delete interview data at any time. If no activity occurs for 3 years, we will contact you before any deletion.
- Anonymised research data: Fully anonymised data may be retained indefinitely for service improvement.
- Technical logs: 90 days.
- Permanent deletion: You can permanently delete an individual interview or an entire project at any time. Permanently deleted data is removed from the production database immediately and ages out of rotating encrypted backups automatically.
Data breach notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours (GDPR Article 33). Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay (GDPR Article 34).
Preparing an ethics application?
Templates for your participant information sheet, consent form, data management plan and AI-use disclosure, for both AI options.
Open the ethics kit
Your role as a researcher
When researchers use Qualitati to conduct interviews, the researcher (or their institution) acts as the data controller for participant personal data. Qualitati acts as a data processor. Researchers are responsible for obtaining informed consent, securing ethical approval, and ensuring compliance with applicable data protection laws.
Questions
For data protection questions, requests or a signed DPA, email contact@qualitati.com.