Company facts, data-protection posture, sub-processor list, EU AI Act position, and the honest single-operator continuity story. If your security or procurement team needs more, the contact at the bottom of the page is real.
Every engagement that touches your customer data runs under a GDPR Article 28 Data Processing Agreement. The DPA is bundled with the MSA at signature. If you need to see it before signing, request it via the contact at the bottom of this page; a redacted version is sent by reply.
Adding to or replacing this list triggers 30 days written notice via the email designated in your MSA. Clients may object on reasonable data-protection grounds.
The Client's chosen helpdesk platform (Gorgias, Intercom, Zendesk, Help Scout, Freshdesk) is not an Eltrus sub-processor. The Client contracts with it directly, and the platform's own data-processing terms apply between the Client and that vendor.
The following vendors process data Eltrus controls in its own right (billing, sales operations, internal documentation, signatory information). They do not process Client end-customer Personal Data on the Client's behalf. Listed for transparency:
Every engagement runs through a Scoped Access Checklist. Access escalates in five stages. We never start with write access.
Credentials live in 1Password Business inside a vault dedicated to each Client. They are revoked at termination within two business days, with confirmation email sent within five.
Eltrus is monitoring the EU AI Act implementation timeline. The 7 May 2026 Digital Omnibus deferred Annex III high-risk AI obligations to 2 December 2027, but Article 4 (AI literacy) and Article 50 (transparency) enforce on 2 August 2026 regardless. Both apply to Eltrus's service.
Eltrus acts as a Deployer of third-party general-purpose AI models (Anthropic Claude, OpenAI GPT) when running AI-assisted customer support inside a Client's helpdesk. The Client may be a co-Deployer depending on how the workflow is configured. The MSA and AI Governance Schedule allocate Provider, Deployer, and downstream-Deployer obligations explicitly per engagement.
Where the AI is responding to a customer in real time, Client end-customers are informed they are interacting with an AI system, in line with Article 50(1) GDPR-style obligations. The exact transparency language is set in the AI Governance Schedule for each engagement.
Where the AI materially influences a refund, cancellation, or subscription decision (typically Tier 2 revenue-recovery flows), the workflow is configured with a confidence threshold above which the decision routes to a human agent. The Client owns the policy that defines the threshold.
Eltrus maintains documented AI literacy for personnel deploying or operating AI on Client systems. On request, we provide a short literacy summary for the Client's own personnel using the deployed system.
Customer data is not used to train any foundation AI model. Anthropic and OpenAI API modes are configured to opt out of training where the providers offer that setting. Zero Data Retention (ZDR) is requested where the Client's risk profile warrants it.
Eltrus is a one-operator business. The founder is the operator. This is the right model for a focused services engagement, but procurement teams reasonably ask what happens if the operator is unavailable.
Weekly KPI reports continue automatically (they're scripted, not manual). Slack-channel critical incidents are routed to a documented contractor who has the access to handle them. The Client primary contact is notified within one business day of the start of any planned unavailability.
Each MSA includes a wind-down clause. If Eltrus cannot deliver for 30 consecutive days for reasons of force majeure or operator unavailability, the Client may terminate for cause with a pro-rata refund of any prepaid retainer fees, and Eltrus delivers a full handoff package (KB articles in markdown, macro documentation, escalation rules, credential rotation instructions) within 10 business days.
All KB articles, macros, prompt content, and helpdesk configuration are Client-owned property under the MSA. They live inside the Client's helpdesk and remain there if the engagement ends. There is no Eltrus platform to migrate off and no separately hosted Eltrus infrastructure that becomes inaccessible.
The honest list. These items are on the roadmap, not in place yet:
Stating gaps publicly is more useful than pretending they do not exist. If you need any of the above to sign, ask via the contact below; we can tell you what is realistic on what timeline.
Email the founder directly. Replies usually inside one business day, often faster.