Trust center

How Munito protects customer data, where it processes the data of each region, and which providers process it.

Request the DPAGet updates by email
Overview
Sub-processors

Controls

Data protection

  • Prompts and outputs are not retained by default.
  • Customer data is never used to train models.
  • EU and US requests run only in their region.
  • Stored files and stored responses expire within 30 days.
  • An owner deletes the organization in the console. Backups clear within 30 days.
  • Application logs drop prompts, documents and outputs.

Network security

  • Every public host uses TLS and HSTS.
  • The EU and US API hosts terminate TLS in their region.
  • DDoS protection covers every public gateway.
  • Clusters and GPU hosts connect over an encrypted private network.
  • Rate limits apply at the gateways and in the API.

Access control

  • Operators reach the clusters through a private network, each with a personal identity.
  • No shared credential gives access to a cluster.
  • Secrets live in a secrets manager, never in code.
  • Passwords are stored as hashes.
  • Bot checks and phone verification protect sign-up.

Infrastructure

  • The infrastructure is code, and GitOps applies each change.
  • A release ships only after every CI check passes.
  • CI holds no cluster credentials.
  • Databases have continuous backups in their own region.
  • Dependencies update automatically every week.

Monitoring

  • Metrics, logs and traces from every cluster, with alerts.
  • External uptime checks and a public status page.
  • A security.txt file on every host names the address for vulnerability reports.

Sub-processors

  • Rented GPUs come only from datacenter hosts.
  • EU requests run only on GPUs in EU member states.
  • Munito publishes each new sub-processor here before it receives customer data.

Sub-processors

  • Microsoft Azure

    Hosts the API, the databases and the stored files of each region.

    France
  • Google Cloud

    GPUs in Munito's clusters, which run the models.

    EU
  • Amazon Web Services

    GPUs in Munito's clusters, which run the models.

    EU
  • Vast.ai

    Datacenter GPUs that run the models when Munito's clusters are full.

    EU
  • Cortecs

    Sends a chat request that opts in to overflow to an EU provider with zero data retention.

    EU
See the full list and the CSV

Updates

  1. Trust center published

    15 October 2026

    This page lists the sub-processors of each region and the controls that protect customer data.