Security
The AI asks. You decide.
The concerns are justified. Here are the answers.
An AI that works in employee data is a serious promise. alluvo does not keep it with a seal but with mechanics: what alluvo may do, you set. What alluvo has done sits in the timeline with a sender.
And what breaks the temporary-agency rules built into alluvo (German law today), alluvo does not merely refuse: it cannot even create it. There is no argument on this page that does not rest on product behaviour or on a contract.
The leash
Autonomy is a setting.
The question is never "AI yes or no" but: how far? In alluvo every task type has a leash with three levels, from "proposes" to "done by". The middle one is preset. Move it and see what changes.
How far may alluvo go?
Stufe 01 · Propose Short leash
alluvo prepares. You create.
What alluvo may do
- Evaluate the client meeting and list the six assignments
- Propose the rate, surcharges and deadlines for each of them
- Tell you what belongs in each of the six contracts
What you do
- Create the contracts yourself
- Check, get them signed, send
Without you nothing happens. Not even time saved.
Stufe 02 · Draft Medium leash Default
alluvo creates. You approve.
What alluvo may do
- Create six staffing contracts as drafts, with rate, surcharges and deadlines filled in for you to review
- Show you beforehand what would be created and wait for your confirmation
What you do
- Review the drafts
- Approve: only then do they become valid
The default, and everywhere: every write action first shows a preview; it is only carried out once a person confirms.
Stufe 03 · Execute Long leash
alluvo does it. You see it.
What alluvo may do
- Create the six contracts and send them to the clients for digital booking
- Log every step in the timeline, recognisable as AI, with time
What you do
- Read along and step in at any time
- Shorten the leash again
Only if you deliberately let go: switched on individually per task type, withdrawn at any time.
A person approves important actions, unless you deliberately let go of the leash.
Principles
Eight statements. No asterisks.
Each of these statements describes how alluvo is built, not what alluvo has set out to do. The difference is the whole point of this page.
- Draft is the default.
- Every write action first shows you what it would do. It is only carried out once a person confirms, across all areas, not only for contracts. Autonomy is a setting, not a default.
- The AI inherits your permissions.
- The assistant works with the account of the person who connected it and runs through the same permission check as the interface: bound to your organisation and, depending on role, limited to the whole data set, the team, the branch or your own data. What you may not do, it cannot do. And access can be withdrawn at any time.
- Only the data the task needs.
- The language model gets the excerpt for the task, not the database. Special categories of personal data, health details for example1, alluvo structurally keeps out of client-facing texts, as well as internal notes that have no business with the client or applicant. The attempt fails; it does not stop at a warning.
- Every action has a sender.
- Timeline and field history show before and after, with time and author. Every change that runs through the AI is marked as such, including the function that triggered it. A machine cannot pass itself off as a human in your history.
- Guardrails in the data model.
- A contract that breaks the stored temporary-agency rules (German law today), equal pay or maximum assignment duration2 is not forbidden in alluvo, it is impossible. The guardrailsRules that live in the data model itself: pay agreement, deadlines and mandatory details are checked before a document even exists. check before the document exists. And for everyone who writes: human and AI alike.
- When it gets personal, a person takes over.
- The AI does not answer employee requests that are about more than information. alluvo passes them on to a named person. Escalation is built in, not an add-on.
- Deleted is not gone.
- The AI cannot permanently delete anything in alluvo. Deleted items go to the recycle bin and can be restored; permanent removal is switched off for AI sessions: not discouraged, switched off.
- A no comes with a reason.
- When alluvo blocks an action, it names the records that are in the way, instead of an error message nobody can do anything with. That is part of oversight too: you should see not only that something did not work, but why.
GDPR & contracts
What is in the contract.
Everything up to here was product behaviour. From here on it is contractual, and therefore short. What is binding is not what stands on a website but what is signed.
- Data processing agreement included
- Using alluvo includes a data processing agreement. It states what is processed for what purpose, for how long and who is involved. The agreement is Annex 1 of the terms of use and comes into being with the use relationship; you can read it including measures and subprocessors, also as a PDF for your records of processing.
- Regulated on all sides
- The agreements with clients, partners and employees are designed around the GDPR. The details are regulated by the data processing agreement; the purposes of processing are in the privacy policy.
- Hosting in Frankfurt
- alluvo runs on Amazon Web Services in Frankfurt, Germany (region eu-central-1): servers and storage in Germany, under European data protection law. For AI tasks the content needed for them goes to Anthropic and OpenAI in the USA, under standard contractual clauses. This is regulated in a binding way in the data processing agreement.
- Your data does not train models
- alluvo does not use your data to train AI models. What applies at the AI providers in use in detail (retention period, processing locations, sub-processing relationships) is regulated by the data processing agreement.
- Your data stays reachable
- Export and open interfaces are part of the product, not an add-on package. Making the exit a project is not a business model.
No seal here. alluvo deliberately cites no certification marks and no standards at this point. What alluvo does you can read above; what alluvo owes is in the contract. Both are verifiable. A logo is not.
Regulation
EU AI Act, soberly.
When AI works in HR, the discussion about the EU AI Act3 comes down to three things: that a person keeps oversight, that it stays recognisable where AI was involved, and that processes can be traced later. At alluvo these are not retrofitted checkboxes but the mechanics you have read about on this page: human approval as the default, a sender on every action, a history on every field. Whether your specific use falls into one of the risk classes, and what follows for you, you clarify with your legal counsel; alluvo promises you no compliance there. It gives you what that is built on.
Ask me the most uncomfortable thing.
20 minutes, no sales pitch. Bring the question you expect me to dodge: hosting, retention periods, liability. You get an answer, or the sentence that I do not know yet.
— Pascal Kremp, founder of alluvo