Trust and data
Trust and data
Where
Työäly runs in Amazon Web Services in Stockholm (eu-north-1): the API, the console, the records, the connectors. The console's pages are delivered from a content network with an origin in the same region.
What is stored
| Product | Kept | For |
|---|---|---|
| Gate | the decision record: action, actor, amounts, outcome, reason codes, scores, the key used, the verdict | 13 months |
| Gate | the content of a request, under the environment's retention mode | full 30 days · redacted · metadata · zero |
| Gate | verdict links from the digest | 14 days |
| Gate | API keys, as hashes | until revoked |
| Control | per-message records (no sender address, no body), the sync state | 90 days |
| All | logs and metrics: ids, counts, timings, outcomes; never content | 30 days |
Who processes what
Gate's decision model is operated by a processor in the United States under a data processing agreement with standard contractual clauses. Control's generative model runs in the European Union. Mail is sent through Amazon Web Services from the EU. The processors are named in the privacy notice, which is kept current when anything in this list changes.
Access
- API keys are shown once and stored as hashes; a revoked key answers
401from the next request. - The console signs in through a user pool with a password and an optional authenticator app; a person belongs to one organisation. Työäly staff access is from named accounts.
- Every record is written under its organisation; nothing reads across organisations.
- Each component has exactly the permissions it needs; secrets live in an encrypted parameter store readable only by the component that uses them.
- Transport is TLS only; the console serves scripts and styles from its own origin only.
Availability and limits
Decisions are answered in well under a second; a slow or absent decision model gives review,
never allow. The gateway throttles bursts; retry with backoff on 429. Caps and budgets per
environment are listed in the API reference.
Agreements
A data processing agreement between your company and Työäly (Nordplug Oy, Finland) is signed before the first live key. Ask for it at hei@tyoaly.fi.
Something missing or unclear on this page? Write to hei@tyoaly.fi.