In Sardona, you document information about your organisation, risks and security measures. Protecting this data is an essential part of operating the platform.
Here you will find an overview of the application and AI infrastructure, access rights and the use of AI.
Sardona’s application and portal servers are operated in Switzerland. Regional deployments in Switzerland are set up for the AI functions.
Burri Consulting is responsible for the development and operation of Sardona.
Access to the platform is via personal user accounts. Roles and permissions determine which information and functions are available to a person.
Access by Burri Consulting employees is limited to the tasks they perform for operations and agreed support.
Sardona logically separates the data of different customers. The assignment to the respective customer area and the access permissions determine which data is accessible.
An audit log records activities within the platform. This allows changes and processing steps to be traced.
The SQL database is encrypted at rest. The application and portal servers are configured for HTTPS connections only and at least TLS 1.2.
Automatic backups are set up for the SQL database. Maintenance and updates are part of operating the platform.
The specific scope of services and the requirements for retention and recovery are set out in the contract documents.
AI supports selected tasks within the platform:
Depending on the function, the AI processes your input and the content from your customer area used for the task. This may include, for example, ISMS documents or information on assets and risks.
For AI support, regional model deployments in Switzerland managed by Burri Consulting are set up. Which content is used depends on the function used and your request.
AI results may be incomplete or incorrect. They serve as support for professional work.
The responsible people review suggestions and decide whether to adopt them. Approvals and decisions remain with your organisation.
If you connect external systems to Sardona, the information required for the respective function is processed via this connection.
The scope depends on the integration set up and the permissions granted. The connected systems are also subject to the operating and data protection terms of their respective providers.
The rules on retention, the return of your data and deletion at the end of the contract are set out in the contract.
This also takes into account the handling of backup copies and any existing retention obligations.
In addition to this overview, the data processing agreements and the technical and organisational measures are decisive for assessing Sardona.
If you have questions about the processing of your data or need documents for your internal review, please contact us.
Get in touch →