Skip to content
AI Service Catalogue

Sample data. All services, vendors and assessments in this proof of concept are fictional.

Back to the catalogue
LLMAssessed

Vettra Chat

Vendor: Vettra Labs

General-purpose chat assistant based on a hosted large language model. Offered as a web interface and an API for drafting, summarising and translating text.

Last updated

Summary

Vettra Chat is suited for general text work that does not involve special categories of personal data. The main open points are support access from the United States and the 30-day retention period. The organisation should consider both before use with personal data.

Assessment areas

  • Privacy

    Medium severity

    The vendor offers a data processing agreement. The service is not designed for special categories of personal data, and the terms do not cover use by children under 13. The organisation must decide which data users may enter.

  • Data flow and retention

    Medium severity

    Customer data is stored in the EEA. Support staff in the United States can access metadata under Standard Contractual Clauses. Prompts and outputs are kept for 30 days by default. Customer data is not used for training on the business plan.

  • Information security

    Low severity

    Single sign-on with SAML and OpenID Connect is supported. Data is encrypted in transit and at rest. The vendor publishes a summary of its latest penetration test.

  • AI regulation

    Low severity

    The vendor describes the service as a general-purpose AI system and publishes a model card and a usage policy. General text work is unlikely to be a high-risk use. Specific uses, such as assessment of pupils, must be considered separately.

  • Exit options

    Low severity

    Administrators can export all chat history as JSON. The agreement can be ended with three months' notice. Content is not locked into proprietary formats.

Actions

Actions for the vendor

  • Medium severity

    Offer zero retention as a standard contract option instead of on request.

  • Low severity

    Publish the locations of support staff who can access metadata.

Actions for the organisation

  • High severity

    Decide and communicate which personal data users may enter.

  • Medium severity

    Make a local assessment of whether a data protection impact assessment (DPIA) is required for the intended use.

Shared actions (vendor and organisation)

  • Medium severity

    Agree on a procedure for reporting security incidents within 24 hours.

Vendor declaration

Answers as given by the vendor. They are not verified unless the assessment says so.

Where is customer data processed and stored?
Data is processed and stored in data centres in Ireland and the Netherlands.
Is any data transferred outside the EEA, and on what legal basis?
Support staff in the United States can access metadata for troubleshooting. The vendor refers to the EU Standard Contractual Clauses.
Is customer data used to train or improve models?
No. Prompts and outputs from business customers are not used for training. This is the default on the business plan and end users cannot change it.
How long are prompts, outputs and logs kept?
Prompts and outputs are kept for 30 days for abuse monitoring and then deleted. Customers can ask for zero retention.
Which subprocessors does the service use?
Cloud hosting provider (EEA), email delivery provider (EEA), support ticket system (United States).
Which security standards or independent audits does the vendor refer to?
The vendor refers to an ISO/IEC 27001 scope for the hosting platform and an annual third-party penetration test.
How can the organisation export its data and end the agreement?
Administrators can export chat history as JSON. Data is deleted within 30 days after the agreement ends.

Vendor comments

  • We plan to make zero retention a standard contract option in the first quarter of 2027.