Security

newslabs.io is hosted on Vercel, served from EU-region edge and serverless infrastructure. All traffic is encrypted in transit using TLS 1.2 or higher, and data is encrypted at rest by our hosting and storage providers. Website content is managed through Sanity, our content management system, which stores no visitor personal data.

Access to production systems and customer data follows the principle of least privilege: it is limited to authorized engineers who need it to operate the service. Internal systems are protected with multi-factor authentication, and access is reviewed and revoked when no longer required.

NewsLabs does not train AI models on customer content, drafts, or source material. Your newsroom's content is used solely to deliver the service to you, never to build, fine-tune, or improve models for us or for anyone else.

Depending on your configuration, NewsLabs can route drafting tasks to models from OpenAI, Anthropic, Google (Gemini), or xAI (Grok). We access these providers through their business and API offerings, which, under the providers' published terms, do not use API inputs or outputs to train their models.

For newsrooms with stricter requirements, NewsLabs also supports local, self-hosted models, keeping content entirely within infrastructure you control, with no external AI provider involved.

For content processed inside the NewsLabs platform (drafts, wire copy, feeds, and source material), your newsroom is the data controller and NewsLabs acts as a data processor under the customer agreement. Personal data collected on this website (such as demo requests) is governed separately by our Privacy Policy.

When your newsroom ingests wires, feeds, or social posts, incidental personal data about people in the news may be processed. That processing happens on your newsroom's behalf and under its editorial responsibility, and the journalism exemption available to newsrooms under GDPR and national press law extends to the processing NewsLabs performs as your processor.

NewsLabs is an editorial drafting and production tool designed to be used under human editorial oversight: every output is reviewed by a journalist before publication. NewsLabs is not deployed for any purpose prohibited under the EU AI Act, and its intended use does not fall within the Act's high-risk categories.

If we become aware of a personal data breach, we will assess it and notify affected customers and, where required, the competent supervisory authorities without undue delay, in accordance with Articles 33 and 34 of the GDPR.

If you believe you have found a security vulnerability in NewsLabs or newslabs.io, please email info@newslabs.io with the subject line “Security”. We will acknowledge your report, investigate promptly, and will not pursue legal action against researchers acting in good faith. A machine-readable contact is published at /.well-known/security.txt.