ISMS Copilot
Security

Data Controls Overview

ISMS Copilot gives you complete control over how long your data is stored and how it's processed. This article explains the three key data controls available in your account settings.

All three controls are accessible from Settings > Data Protection. To open Settings, click your user menu in the top-right corner and select "Settings".

Automatic Defaults for New Accounts

When you create a new account, ISMS Copilot may initialize some settings automatically based on your browser's language preference:

You can review and change these defaults anytime in Settings.

Data Retention Settings

You can define exactly how long your conversations and uploaded files are kept in our database. Once data exceeds your retention period, it's automatically and permanently deleted.

How It Works

A daily automated deletion job runs in the background, scanning for conversations and files older than your configured retention period. When found, this data is permanently removed from our database with no possibility of recovery.

Configuration Options

You can set your retention period from 1 day to 7 years, or choose "Keep Forever" to disable automatic deletion entirely.

To change your retention period:

  1. Go to Settings > Data Protection

  2. Enter your desired retention period in days, or click "Keep Forever"

  3. Click "Save"

If you reduce your retention period, all conversations and files older than the new period will be immediately and permanently deleted. You'll be asked to confirm this action.

What Gets Deleted

The automated deletion removes:

  • All messages in conversations older than your retention period

  • Uploaded files (PDF, DOCX, XLS) associated with those conversations

  • All related conversation metadata

Advanced Data Protection Mode

Advanced Data Protection Mode routes all AI processing through Mistral AI, a European provider with zero data retention, ensuring your data never leaves the EU and is never stored by the AI provider. This eliminates the need for Transfer Impact Assessments (TIA) on AI processing under GDPR.

How It Works

When enabled, all AI operations—chat responses, document analysis, and policy generation—are processed exclusively by Mistral AI using EU-hosted infrastructure (Frankfurt). Mistral implements zero retention: your prompts and responses are processed in real-time but never stored or used for training.

When disabled (default), ISMS Copilot uses Anthropic Claude for chat responses, xAI Grok for document generation, and OpenAI GPT for detection, which involve US-based processing and 30-day temporary retention. These transfers are protected by Standard Contractual Clauses and supplementary measures as documented in our Transfer Impact Assessment.

Technical Details

  • Models used: mistral-large-latest (chat), magistral-medium-2509 (document analysis and generation)

  • Provider retention: Zero retention when enabled; 30-day cache when disabled

  • Data location: All processing happens in EU data centers

  • Training: Your data is never used to train AI models when enabled

Enabling Advanced Data Protection

  1. Go to Settings > Data Protection

  2. Toggle "Advanced Data Protection Mode" to ON

  3. Your next conversation will be processed through Mistral AI

This setting affects new messages only. Existing conversations processed before enabling this mode are not retroactively affected.

Content Moderation Exception

All messages are screened for harmful content, regardless of Advanced Data Protection Mode status. Flagged content is stored for 1 year in the ISMS Copilot EU database and triggers admin alerts. Non-flagged message metadata is retained for 30 days for system monitoring.

PII Reduction Mode

PII Reduction Mode automatically redacts personally identifiable information from your messages before they're sent to AI providers, adding an extra layer of privacy protection.

How It Works

Before your message reaches any AI provider, pattern-based detection scans for common PII patterns and redacts them:

  • Names → [REDACTED_NAME]

  • Email addresses → [REDACTED_EMAIL]

  • Phone numbers → [REDACTED_PHONE]

  • Company names → [REDACTED_COMPANY]

The AI processes the redacted version, so sensitive information never leaves your browser in its original form.

Enabling PII Reduction

  1. Go to Settings > Data Protection

  2. Toggle "PII Reduction Mode" to ON

  3. Read the limitations notice and click "Understood"

  4. A green shield icon will appear to confirm PII reduction is active

Limitations and Accuracy

PII Reduction uses regex pattern matching and is not 100% accurate. It may miss contextual information, some ID formats, or incorrectly redact non-PII text. This is not full anonymization and should not be relied upon for highly sensitive data.

For maximum privacy, combine PII Reduction Mode with Advanced Data Protection Mode. PII redaction happens first (in your browser), then the redacted message is sent to Mistral AI with zero retention.

Combining Data Controls

You can enable all three controls simultaneously for maximum data protection:

  • Short retention period ensures data is deleted quickly from our database

  • Advanced Data Protection ensures zero retention by AI providers and EU-only processing

  • PII Reduction prevents sensitive details from reaching AI providers in the first place

All three settings are available on all subscription plans and take effect immediately after saving.

Was this helpful?
Was this helpful?