Security

The NewsLabs platform, its database, file storage, logs and backups run on Amazon Web Services in the eu-central-1 region in Frankfurt, Germany. This website and the platform frontend are served by Vercel from its Frankfurt region and a global edge network. Data is stored within the European Economic Area.

Of the AI and transcription providers listed below, Mistral, Speechmatics and Amazon Transcribe process content within the European Union. OpenAI, Google (Gemini and Vertex AI), Anthropic (Claude) and xAI (Grok) process it outside the EEA. Those transfers take place under the European Commission's Standard Contractual Clauses, as set out in the Transfers outside the EEA section of the Privacy Notice.

Depending on the workflow, prompts, editorial content, source text, files, media and generated output are sent to the following providers, which act as our subprocessors for that content:

• OpenAI. OpenAI Ireland Limited. Processing in the United States. Transfers take place under Standard Contractual Clauses.
• Google (Gemini and Vertex AI). Google Cloud EMEA Limited and Google LLC. Processing through Google's global endpoint, which may take place outside the EEA, including in the United States. Transfers take place under Standard Contractual Clauses.
• Anthropic (Claude). Anthropic Ireland, Limited. Processing in the United States, with model inference routed globally, so it may also take place elsewhere outside the EEA. Transfers take place under Standard Contractual Clauses.
• xAI (Grok). SpaceXAI LLC, formerly X.AI LLC. Processing in the United States. Transfers take place under Standard Contractual Clauses.
• Mistral. Mistral AI SAS. Processing in the European Union.
• Speechmatics. Speechmatics Limited. Processing in the European Union (EU region). Any access from the United Kingdom is covered by the European Commission's adequacy decision for the United Kingdom.
• Amazon Transcribe. Amazon Web Services EMEA SARL. Processing in the eu-central-1 region, Germany.

We use each provider under its business and API terms, under which none of them trains its models on the data we send. Nothing is published automatically: journalists control the source material, review every input and output, and decide what is published. The Platform makes no automated decisions about people within the meaning of Article 22 GDPR. The full list of providers, legal entities and processing locations is in Schedule 2 of the Privacy Notice.

We do not train AI models on identifiable customer content, drafts or source material. The third-party AI providers we use do not train their models on data we send them. We may use aggregated, anonymised usage data and anonymised output to improve the product. Anonymised data no longer identifies a person, a newsroom or a specific piece of content.

For editorial content processed in the platform, such as drafts, wire copy, feeds, uploaded files and source material, your newsroom is the data controller and NewsLabs acts as a data processor on its documented instructions, under the Data Processing Addendum in the customer agreement. Your newsroom decides what goes in, why, and what happens to it, including how any rules on processing for journalistic purposes apply to it.

For account data, security logs and analytics, and for personal data collected on this website such as demo requests and newsletter sign-ups, NewsLabs is the data controller. The Privacy Notice covers that processing.

This website uses Umami Cloud for analytics. It sets no cookies and stores nothing on your device, so the website shows no cookie banner. The platform uses PostHog, hosted in PostHog's EU Cloud in Frankfurt, for product analytics and error tracking. You can switch platform analytics off at any time. The platform also uses Vercel Web Analytics and Vercel Speed Insights, which set no cookies either. The Cookies section of the Privacy Notice lists every cookie and storage key we use.

We do not use advertising, retargeting or profiling cookies, and we do not sell personal data.

Editorial content stays for as long as your newsroom's account and agreement require, and is deleted or returned afterwards in accordance with that agreement. Technical data has fixed retention periods, such as 30 days for application and error logs. The retention section of the Privacy Notice lists every period.

Where NewsLabs is the data controller, you can ask for access to your data, have it corrected or deleted, restrict or object to its processing, receive a copy, withdraw consent, or complain to the Croatian Personal Data Protection Agency (AZOP). Requests about editorial content go to the newsroom that processes it; if you send one to us, we forward it without undue delay. See Your rights in the Privacy Notice.

Accounts are created by your newsroom's administrator; there is no public sign-up. Each account is personal: keep your credentials confidential, do not share your account, and tell us and your administrator immediately if you suspect it has been compromised. Scraping, reverse engineering, security testing without our written permission and using the platform to create unlawful content are not allowed. Your newsroom owns the content generated for it, and is responsible for reviewing it and for any required disclosure that it was produced with AI assistance. The Terms of Use set this out in full.

NewsLabs is an editorial drafting and production tool designed to be used under human editorial oversight: every output is reviewed by a journalist before publication. NewsLabs is not deployed for any purpose prohibited under the EU AI Act, and its intended use does not fall within the Act's high-risk categories.

If we become aware of a personal data breach, we will assess it and notify affected customers and, where required, the competent supervisory authorities without undue delay, in accordance with Articles 33 and 34 of the GDPR.

If you believe you have found a security vulnerability in NewsLabs or newslabs.io, please email info@newslabs.io with the subject line “Security”. We will acknowledge your report, investigate promptly, and will not pursue legal action against researchers acting in good faith. A machine-readable contact is published at /.well-known/security.txt.