Privacy and security
Last updated 11 August 2026
Everything a buyer, data protection officer or union representative needs to assess SimLab, collected on one page. We have tried to be as clear about what we do not do as about what we do.
How we handle data
Eight claims we can evidence in the code or in the contracts.
We never store audio
Only the text transcript of the conversation is stored. The audio columns were removed from the database — there are no audio files to request access to.
We never analyse the voice
Inferring emotion from voice is biometric processing and prohibited in the workplace under Article 5 of the EU AI Act. Tone is derived from text, and the feature requires the individual's active consent.
Training data is stored in the EEA
Transcripts, feedback and training history sit on servers in Germany. Our authentication and AI providers are US-based — see the subprocessor list.
Managers never see the conversations
No endpoint exists that lets an administrator read someone else's transcript. Individual results are hidden by default, and in pilot mode they cannot be enabled. The feedback is formative reflection support for the person practising — not a staff appraisal, a certification test, or a diagnostic tool.
No names are sent to the AI providers
The evaluation receives the conversation text, not who held it. Names, emails and account identifiers are not included.
Uploaded documents are never stored
If you upload an incident report to build a scenario, it is read in memory, scrubbed of personal data before being sent on, and discarded.
Self-service access and deletion
Any individual can download a complete copy of everything we hold, or delete their account permanently — without asking anyone.
Retention
Data is kept for as long as the account is active and permanently deleted when the account is deleted. We do not yet offer a configurable automatic retention limit; it is on the roadmap, and we will say so when it lands.
Subprocessors
These process data on our behalf. Transfers outside the EEA rely on the EU Standard Contractual Clauses.
| Provider | Location | What it is used for |
|---|---|---|
| Clerk | USA | Authentication and account management. |
| OpenAI | USA | Real-time speech processing during the session. |
| Anthropic | USA | Feedback based on the text transcript. |
| Groq | USA | Alternative language model for feedback. |
| Simli | USA | Video avatar. Receives only the AI voice, never the participant's audio or identity. |
| Resend | USA | Transactional email and contact-form enquiries. |
| Hetzner | Tyskland (EØS) | Server and database hosting. |
Changes are announced to organisation customers before a new subprocessor is engaged, in line with the data processing agreement.
Documentation
Accessibility
SimLab is developed towards WCAG 2.1 level AA. We are not finished: an accessibility statement is being prepared, and we will happily report the status of specific success criteria during a procurement process. Ask us, and we will answer honestly about what has been tested and what has not.
The company
SimLab ASBergen, NorgeQuestions?
Privacy questions and subject access requests are normally answered within one month. support@simlab.no