> For the complete documentation index, see [llms.txt](https://trust.memori.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://trust.memori.ai/en/certifications/certifications-overview/iso-certifications/iso-27018-2020-certificate.md).

# ISO 27018:2020 Certificate

The certification that ensures personal data processed through AIsuru remains the exclusive property of the customer and is never used by Memori for its own purposes.

### What it is

ISO/IEC 27018:2020 establishes the principles and controls for the secure processing of personally identifiable information (PII) by public cloud service providers acting as Data Processors.

### The fundamental principle: data stays with the customer

The central principle of ISO 27018 is that Memori, as Data Processor, does not use customer data for its own purposes. This includes:

* **No use for training AI models** – Agent and conversation data is never used to train or modify Memori's NLP models or external LLM models
* **No unauthorized sharing** – data is not passed on to third parties without the customer's explicit consent
* **No commercial profiling** – conversation data is not analyzed for Memori's marketing purposes
* **Data remains the customer's property** – the customer can export, delete or transfer it at any time

### What it concretely guarantees

**Categories of personal data processed by Memori on behalf of the customer:**

* **Conversation data:** text of the messages exchanged between end users and AI Agents
* **Profile data (if the user is registered):** email, username, date of birth
* **Known facts (only if the "Deep Thinking" feature is enabled with the end user's explicit consent):** information inferred from conversations
* **Session metadata:** anonymized IP, user agent, timestamp

**Specific controls applied:**

* **Transparency:** the customer is informed of all sub-processors (cloud, LLM providers) that may access the data, along with their data retention policies
* **Minimization:** data is processed exclusively to provide the contracted service
* **Secure deletion:** when an Agent or an account is deleted, all associated data is permanently deleted. Only system logs that do not contain the content of conversations remain
* **EU data residency:** all the main infrastructure is located in Europe (Italy, Ireland, Germany)
* **Limited access:** Memori superadmins have visibility of platform operations but have no access to the content of conversations and Agents

**LLM provider data retention times:** When the customer chooses to use an external LLM provider, the data sent for inference is subject to the provider's policies:

| Provider       | Retention                                                               |
| -------------- | ----------------------------------------------------------------------- |
| OpenAI (API)   | max 30 days (only to prevent abuse); zero retention for text moderation |
| Anthropic      | max 30 days (only to prevent abuse)                                     |
| Google Vertex  | max 30 days (only to prevent abuse)                                     |
| Azure OpenAI   | max 30 days (only to prevent abuse)                                     |
| Amazon Bedrock | zero data retention                                                     |
| Mistral (EU)   | max 30 days (only to prevent abuse)                                     |

Based on the policies published by each provider, none of them uses enterprise API data to train its own models. For updates on the policies of individual providers, please refer to their official documentation.

### How it applies in practice

When a customer company configures an AI Agent on the AIsuru platform with confidential company data (documents, procedures, knowledge bases), ISO 27018 ensures that:

* Such data is processed exclusively to make the Agent work
* Memori cannot use it for any other purpose
* The customer can revoke, modify or delete it at any time
* At the end of the contract, the data is deleted in a secure and documented manner

{% file src="/files/aUxi0x4Ln8gKrNQp3cKJ" %}