Chut

Security & Trust

Built in Europe. Designed to protect your data.

Chut is engineered from day one around EU data residency, GDPR compliance, and the principle that you stay in control. No shortcuts, no small print.

Works inside
  • E-mail
  • WhatsApp
  • Voice
  • Documents
  • Runs on our own AI
  • 100% EU-hosted
  • GDPR by design
  • EU AI Act ready
  • Built in Belgium

Your data never crosses the line

One boundary, drawn around everything: encrypted in, processed in EU datacenters, walled off per business, every action recorded.

Diagram: your business exchanges data with Chut, which processes and stores it in isolated, per-business vaults — all inside one European Union boundary. Every action is written to an audit log. No data path leaves the EU boundary. European Union Your business encrypted Chut processed in EU datacenters GDPR by design Business A fully isolated Business B fully isolated Business C fully isolated Audit trail every action recorded
  1. 1

    Encrypted in transit. Data enters over TLS — the lock on the border.

  2. 2

    Processed in the EU. Hosting, processing, storage — nothing crosses the boundary.

  3. 3

    Walled off per business. Every company's data is fully isolated.

  4. 4

    Everything recorded. Every action lands in the audit trail.

The AI is ours, too

Most AI tools send your text to a third-party model API and hope the terms don't change. Chut doesn't. We took an open-source foundation model, trained it further ourselves — continued pretraining and supervised fine-tuning on our domain — and we run it on European servers we operate and control, 100%.

No third-party AI in the data path

Your documents and messages are processed by our own model, on our own machines. They are not sent to an external AI provider for inference.

Trained for this work

Continued pretraining and supervised fine-tuning on European business and legal content, in Dutch, French and English — not a general-purpose model doing its best.

Sovereign by construction

Model weights, inference, and data all live on EU infrastructure we operate. No model-provider dependency, no overnight API price or policy change.

See how it performs against a leading frontier model on the technology page.

Your data stays in Europe

Chut is hosted entirely within the European Union. Your documents, messages, and business data never leave EU infrastructure — not during processing, not in storage, not ever.

  • EU-based cloud infrastructure only
  • Data residency guaranteed — no third-country transfers
  • Chut.App BV is a Belgian company — subject to Belgian and EU law

Legal entity

Chut.App BV

Ballingstraat 116
8560 Wevelgem, Belgium

BCE BE 1035.742.145 · VAT BE1035742145

Incorporated, operating, and accountable under Belgian and EU law. No offshore holding. No regulatory arbitrage.

GDPR by design

Privacy is not a feature we bolted on at the end. GDPR compliance is a core design constraint — every data flow, every storage decision, every integration is evaluated against it.

Your data is yours

We process your data to deliver the service. Full stop. You retain ownership and control at all times — we act only as your data processor.

Lawful processing only

Every processing activity has a documented lawful basis. We apply data minimisation — we only collect what is strictly necessary for the task at hand.

Deletion on request

You can request deletion of your data at any time. We honour right-to-erasure requests promptly and without friction.

Read the full details in our Privacy Policy.

Legal documents, no chasing required

We publish the documents you need for GDPR-compliant supplier due diligence — available to every customer, upfront.

Data Processing Agreement

Our DPA sets out how we act as your data processor under GDPR Article 28. Governs what we process, why, and your rights as data controller.

Read the DPA

Sub-processors published

We publish a full list of every third-party sub-processor we use, what they process, and where they are located — kept up to date.

View sub-processors

Encrypted in transit and at rest

Your data is protected at every point in its journey — from your browser to our servers, and while it sits in storage.

In transit

All connections between your browser, our API, and our infrastructure use TLS. No data travels in the clear. HSTS enforces secure connections from the first visit.

At rest

Data stored on our servers is encrypted at rest using managed EU cloud infrastructure with encryption enabled by default. Storage keys are managed by the cloud provider's key management service.

You stay in control

Chut works on your behalf — but nothing important happens without your explicit approval. Human-in-the-loop is not a feature flag. It is the default.

Human-in-the-loop approval

Every draft — reply, invoice, quote, contract, follow-up — is shown to you for approval before anything is sent or filed. No silent actions. Ever.

Role-based access

Access controls let you decide which team members can see and approve which tasks. The right person reviews the right item — no over-sharing of sensitive data.

Our principles

Two things we will not compromise on — because trust is the product.

Built for the EU AI Act

We are building Chut with EU AI Act obligations in mind: transparency, human oversight, and risk-awareness are built into the design from day one — not bolted on at the last minute.

We do not sell your data

Your business data is not a product. We do not sell, rent, or share your data with third parties for advertising or any commercial purpose — not now, not ever.

See where AI fits your business

Book a free workflow audit: about 30 minutes with our team. We map where your time goes, and the written report is yours to keep.

Book your free workflow audit

A ~30-minute working session — leave your details and we'll set it up.

No long forms. No commitment. The report is yours to keep.