Your data stays in your company.
Colle stores your team's handoffs, facts and files in the EU (Frankfurt), keeps every company's data apart on every database query, encrypts each person's personal data with their own key and records every change in a tamper-evident audit log.
In short
EU hosting
Frankfurt, encrypted disks, daily backups.Tenant isolation
Row-level security on every query.Space permissions
People only see cases in their spaces.Encrypted personal data
A separate key per person; erasure destroys the key.Prompt-injection guard
Colleague text is marked untrusted and scanned.Tamper-evident audit
Hash-chained log, exportable by admins.
Where your data lives
Colle runs on Fly.io in Frankfurt, Germany. The application, the database and file storage stay in the EU. Disks are encrypted, traffic is encrypted with TLS, and the database is backed up every day.
Fly.io is a company based in the United States; the transfer safeguards are listed in the privacy policy.
Who can see what
Every handoff goes either to named people or to a space. A handoff to a person is seen only by the sender and the people it was sent to. A handoff to a space notifies every member except the sender, and one of them picks it up.
An open space lets everyone in the company read its cases; only members get notifications. A closed space is visible to its members only. Administrators manage people and spaces. Work forwarded to someone else travels with its full history.
Each company's data is isolated by row-level security in the database on every query, so one organisation's request can never read another's rows.
Personal data
Personal data inside facts is encrypted with a separate key for each person. Erasing a person destroys their key, so their personal data in facts can no longer be read.
Personal data is never passed on to people who do not have access to it.
AI assistants and your data
Colle works inside Claude (Anthropic) and ChatGPT (OpenAI). When you ask your assistant to hand off or read work, the assistant provider processes that conversation under your own or your organisation's agreement with them. They are not Colle's sub-processors, and Colle does not send them data on its own.
Colle does not use personal data or customer data to train AI models, and does not sell personal data.
Prompt-injection guard
Text that arrives from a colleague, a file or another assistant is data, not instructions. Colle marks it as untrusted before your assistant reads it, scans it for text that looks like instructions to an AI, and warns when it finds some.
Audit log
Handoffs, status changes and fact edits are written to an audit log in which each entry is linked to the previous one by a hash chain, so a changed or removed entry shows. Administrators can export the log.
Retention and deletion
- Customer data: kept for the subscription, deleted within 30 days after it ends and from backups within the following 14 days.
- Security and request logs: 30 days.
- Pilot sign-ups: 12 months, or earlier on request.
- An administrator can export or delete company data at any time.
Sign-in
During the pilot, people sign in through Colle's own sign-in page with their email and password. Single sign-on (OIDC) and automatic people sync (SCIM) are set up with your team when you need them.
GDPR and contracts
For your team's content (summaries, facts, files and cases) Colle is the data processor under a data processing agreement (DPA); for the website, accounts and billing it is the data controller.
The DPA is available on request: email michael@trycolle.com with the subject “Colle DPA request”. If a personal data breach is likely to put people's rights at risk, Colle notifies the supervisory authority within 72 hours where it is the controller (website, accounts, billing), and notifies your organisation without undue delay where it processes your team's content for you (GDPR Articles 33–34). Supervisory authority contacts are in the privacy policy.
Report a security issue
Found a vulnerability? Email michael@trycolle.com. We reply within one business day.
See Colle work in 15 minutes.
We'll run it live with your own example — a client handover, a contract, a bug report or anything else.