Skip to content
AI Service Catalogue

Sample data. All services, vendors and assessments in this proof of concept are fictional.

Back to the catalogue
LLMIn review

Kelpo Text API

Vendor: Kelpo Analytics

API for text generation and classification with a choice of open-weight models hosted by the vendor. Intended for integration into the organisation's own systems.

Last updated

Summary

The assessment is in progress. Findings and actions can change.

So far, requests are not stored and data stays in the EEA. Information security and AI regulation are still being reviewed.

Assessment areas

  • Privacy

    Low severity

    Requests are processed without storage. A data processing agreement is available. Access logs contain IP addresses, which are personal data.

  • Data flow and retention

    Low severity

    Processing and backups take place in Finland and Sweden. Access logs are kept for 90 days.

  • Information security

    Not yet assessed

  • AI regulation

    Not yet assessed

  • Exit options

    Low severity

    The API uses a widely used request format, so a change to another provider needs only limited changes to the integration.

Actions

Actions for the vendor

  • Medium severity

    Document the security programme and share the results of the planned external audit.

Actions for the organisation

  • Medium severity

    Check whether the integration sends personal data in requests, and limit it where possible.

Vendor declaration

Answers as given by the vendor. They are not verified unless the assessment says so.

Where is customer data processed and stored?
Processing takes place in a data centre in Finland. Backups are stored in Sweden.
Is any data transferred outside the EEA, and on what legal basis?
No transfers outside the EEA, according to the vendor.
Is customer data used to train or improve models?
No. Anonymised usage statistics are used for capacity planning.
How long are prompts, outputs and logs kept?
Requests are not stored after the response is returned. Access logs with IP addresses are kept for 90 days.
Which subprocessors does the service use?
Data centre operator (Finland), backup provider (Sweden).
Which security standards or independent audits does the vendor refer to?
Internal security programme based on ISO/IEC 27002. An external audit is planned for 2027.
How can the organisation export its data and end the agreement?
No customer content is stored, so there is nothing to export. API keys are revoked when the agreement ends.

Vendor comments

No comments from the vendor.