Security & Privacy
Security, privacy and AI data handling
Arqlee turns sensitive portfolio data into decisions you can defend. This page explains exactly where your data runs, what Arqlee needs, and what it deliberately does not.
EU infrastructure
App and primary data storage in the EU
Data minimization
No personal end-user data required
No training use
No model-training use under contract
DPA on request
Contractual basis for processing
Four questions you can settle before we talk
Answered briefly and verifiably, without overstated promises.
Where does your data run?
App infrastructure and primary data storage are in the EU. We prefer Germany where possible, otherwise the EU. AI analyses run through selected enterprise APIs with documented safeguards.
What data does Arqlee need, and what not?
Arqlee works with portfolio signals: applications, cost, lifecycle, criticality and ownership. Personal end-user data is not required. Credentials for connected sources are stored encrypted.
What happens to your documents?
Transfer over TLS, encrypted storage. Decryption happens only for the analysis itself. Raw data, documents and customer-specific Decision Packs are not used for other customers. For future industry benchmarks, Arqlee may only use anonymized, aggregated structural patterns without identifying individual companies; customers can exclude benchmark use by contract. On request, we delete your documents after the engagement.
What are the limits of the platform?
Arqlee is import-first; there is no uncontrolled live access to your systems. Every AI recommendation is reviewed by an enterprise architect. You never receive unreviewed AI output. Application Rationalization is what runs in production today.
How Arqlee works with AI
At Arqlee, AI is a tool, not a black box. Every assessment is purpose-bound, traceable, and reviewed by a human.
Purpose-bound
Your data is processed solely for your engagement, not for unrelated purposes.
No training use
Neither Arqlee nor the providers used train their own models on your data, per contractual terms.
Vetted providers, expert review
AI analyses run through selected enterprise APIs with documented safeguards. An enterprise architect reviews the results.
Data Trust
Traceable decisions instead of an AI black box
Arqlee shows not only a recommendation, but what it is based on: which data came from the import, where fields are missing, which assumptions were added, and how defensible the decision is.
Data provenance
Recommendations remain traceable down to imported sources and fields.
Coverage
Arqlee shows which decision-critical fields are backed by data and where gaps remain.
Confidence
Assessments carry a defensibility signal instead of smoothing over missing data.
Expert Review
An enterprise architect reviews recommendations, prioritization, and limits before the Decision Pack.
Providers, sub-processors, and concrete processing terms are disclosed in the DPA.
EU infrastructure and GDPR
In the German-speaking mid-market, data sovereignty is a prerequisite, not a detail. We word this precisely rather than maximally.
Hosting
App infrastructure and primary data storage in the EU, Germany preferred.
Encryption
TLS in transit, encrypted storage, purpose-bound decryption.
Data processing
DPA available on request as the contractual basis.
Data minimization
Only the signals a decision needs, no end-user personal data.
Benchmarks
Only anonymized, aggregated structural patterns; customers can exclude benchmark use by contract. No company names, raw data or identifiable customer details.
Who is behind Arqlee
Arqlee is built in Germany, based in Essen, North Rhine-Westphalia. The team comes from enterprise architecture and IT portfolio practice and understands the reality of grown IT landscapes.
Practice fields
Enterprise architecture management, business architecture, application architecture, data and infrastructure architecture.
Focus
Application rationalization, business processes, and capability management.
Value
Arqlee delivers the defensible decision basis: which applications create cost, risk, or redundancy, which actions deserve priority, and which assumptions sit behind them.
Relief
You decide from clear priorities and can focus on your business instead of coordinating months of data work, reports, and tool rollouts.
Open questions about security or privacy?
Let us settle them directly. In a short conversation we walk through your specific data and compliance setup.