Privacy is the architecture
Custodian is built so that protecting the employee is not a feature we added. It is the structure that every other feature rests on.
Every conversation takes the same three stages, in this order
There is no path around them.
Capture, under the employee's control
The browser extension asks for access to four assistant sites only, and records nothing until the employee switches capture on. The text waits in the browser, where the employee can read it, remove a chat, exclude a chat for good, or delete everything. Once sent, no readable chat text stays in the browser.
De-identification before storage
On arrival, and before anything is written to disk, Presidio (open source) replaces names, emails, phone numbers, postal addresses, card and bank numbers, national ID numbers, IP addresses, links and places. The username is replaced by an anonymous ID. Automatic detection is not perfect: a name typed without capital letters can be missed, so we describe this step as strong, not perfect.
Analysis on your own hardware
A model built on Apertus, the open model of the Swiss AI Initiative, reads the de-identified text on a single machine and calls no external AI service. Each participant sees only their own dashboard. HR sees only figures combined over five or more participants.
What protects the data at each layer
No external AI service
De-identification and analysis both run inside the Custodian service. Conversation text is never sent to a model provider. The machine that stores and analyses the records is agreed with you in writing, and it can sit inside your own network.
Encryption and credentials
Connections between the extension, the website and the service use TLS. Passwords are stored as Argon2 hashes and session tokens only as hashes. The extension never stores the password. Disk encryption of the machine that holds the records is part of the agreement.
Who can see what
A participant sees their own dashboard and nothing else. The Custodian administrator sees participation counts under anonymous IDs. HR sees its own organisation only, as figures combined over at least five participants; the service withholds any figure, state or week with fewer. HR accounts are created by Custodian, one per customer, and cannot send or read conversations. Sign-up needs an invite code, and the administration interface answers through the website only.
Export and erasure, built in
Every participant can download everything the service holds about them, and erase their account together with all of its records, from their own account and without asking anyone. Erasure asks for the password again, so a stolen session cannot wipe an account.
Built to support the law that applies to you
Custodian helps organisations meet their own obligations. It does not replace their assessment.
EU General Data Protection Regulation
Built for data subject rights: every participant can export and erase their data from their own account.
Swiss Federal Act on Data Protection
Designed for the revised Act (nFADP / revDSG, in force September 2023), including data subject rights, data security and breach notification.
Annex III, employment
AI systems used in employment can fall under the high-risk category. Custodian does not yet hold a conformity assessment. Before deployment we go through the classification and the transparency duties with you and your data protection officer.
Responsible disclosure
If you find a security issue in Custodian, report it to us before public disclosure. Send a description of the issue, the steps to reproduce it and the possible impact to info@custodian.health. We read every report and answer as quickly as we can.
We will not take legal action against researchers who report in good faith and do not access, change or disclose user data beyond what is needed to show the issue.
Questions about security?
We are happy to walk you through the architecture and the data flows.