Xavio
What this page is
Your company enters into Xavio the personal data of its own customers, suppliers and employees. Under the GDPR, your company is the controller of that data and we are its processor. This page sets out the terms on which we process it, and is part of the contract for the use of Xavio.
If your company needs a separate signed data-processing agreement, write to contact@xavio.ro.
Subject matter and instructions
We process the data only to provide Xavio: to store it, show it to the users your company authorises, produce the documents your company asks for, send those documents where your company directs, and keep the whole thing running and backed up.
We act on your company's instructions. Operating the application as it is documented is that instruction; anything beyond it is agreed in writing. We do not use the data for our own purposes, we do not sell it, and we do not use it to train anything.
Categories of people and of data
People: your company's customers and suppliers (including natural persons and the contact people of companies), its employees and collaborators, and the users of your workspace.
Data: name, company name, tax number, address, telephone, email, bank account; commercial and accounting documents with the amounts and the history they contain; and the technical trace of use — who did what and when.
Xavio is not built for special categories of data (health, biometrics, political or religious views) and we do not expect them. If your company chooses to put such data into a free-text field, it does so as controller and on its own assessment.
Subprocessors
We use the following subprocessors, each bound to equivalent obligations:
- Hetzner Online GmbH Germany (Nuremberg)
Hosting of the application and the database. - Hetzner Online GmbH — Storage Box Germany (Falkenstein)
Backups, encrypted before they leave the server. - Cyber_Folks SRL Romania
The mail server used to send platform messages and the company documents sent to its customers. - Anthropic Ireland, Limited (Anthropic) Ireland (the contract); data is stored in the US
The language model behind Xavi, the AI assistant — only for the companies on which Xavi is used. Details in the Xavi transparency statement. - sendSMS.ro / SMSO.ro Romania
Sending text messages — only if the company enables the channel and configures its own API key.
We tell your company before adding a new subprocessor that touches its data, so it has time to object.
Transfers outside the EEA: only through Xavi
The application, the database, the backups and the mail server are in the European Economic Area — Germany and Romania.
The one exception is Xavi, the AI assistant. On a company where Xavi is used, the questions put to it and the company data it reads to answer them go to Anthropic, which stores data in the US and may process it in the US, Europe, Asia and Australia. The safeguard is the standard contractual clauses of the European Commission (Decision (EU) 2021/914), incorporated into Anthropic's Data Processing Addendum. What exactly leaves, and for how long it is kept, is on the Xavi transparency statement page.
Apart from Xavi, no personal data is transferred outside the EEA. If that has to change, your company is informed in advance, together with the safeguard relied upon.
Security measures, concretely
- HTTPS only; the server accepts key-based sign-in for one administrative account.
- Passwords stored as hashes; two-step authentication available to every account.
- Each company isolated in its own workspace; rights evaluated per company.
- An audit log of the actions taken on documents, rights, roles and settings, which the company can read itself.
- Nightly database dump, verified, kept 7 days locally, plus an encrypted off-site copy (7 daily / 4 weekly / 6 monthly), checked by a watchdog that raises an alarm when a night is missed.
- Changes reach the server only from the version-controlled repository, never edited in place.
Help with requests from data subjects
When a person asks your company for access, correction, deletion or a copy of their data, the company answers; we help with what the application cannot do on its own. Most of it it can: lists, exports and documents are reachable by the company itself.
If such a request arrives at us directly, we do not answer it on the merits. We pass it to your company and tell the person who the controller is.
Incidents
If we discover a breach of security that affects your company's data, we tell the company without undue delay, with what we know at that moment: what happened, which data is affected as far as we can tell, and what we are doing. We do not wait for a complete picture before the first message.
How long, and what happens at the end
We keep the data for as long as your company uses Xavio. On termination the workspace stays available for export 30 days, then it is deleted. Backups containing it roll off on their own schedule, within six months at the latest.
The owner of a company can start the complete deletion of the workspace earlier, from Settings → General → Organisation. That path is deliberately strict: only the owner, only when no other user is attached, and with repeated confirmation — because it cannot be undone.
Evidence
On request we provide the information your company needs to show that it chose a processor that offers sufficient guarantees: the list of subprocessors, the location of the data, the security measures, and the way we handle incidents. We do not grant access to the systems of other companies, for the same reason we do not grant anyone access to yours.