Home / Case studies / Alpha-Privacy
AI compliance platformAlpha-Privacy
Based in Germany, Alpha-Privacy is an AI-powered SaaS platform for GDPR compliance, built around the Record of Processing Activities that Article 30 requires. Its AI assistant drafts each record from the organisation’s own context, while personal data stays inside the tenant and never reaches the model.
Business challenge
GDPR Article 30 requires every organisation that processes personal data to keep a Record of Processing Activities: what it collects, why, on which legal basis, who receives it, where it goes and how long it is kept. The client set out to build a platform where AI drafts that record and a person approves it.
The difficulty sat in the AI itself. A compliance tool that sent its customers’ personal data to a language model would break the rules it exists to enforce. The platform also had to serve separate organisations from one deployment, work in English and German, and keep its data in the EU.
Our scope included
- Translating GDPR compliance workflows into product features, from the client’s business and domain requirements
- Architecture and build across frontend, backend, database, authentication and infrastructure
- Customer-specific AI features with structured outputs and tenant context
- A privacy-preserving design that keeps personal data inside the tenant boundary
Product overview
Alpha-Privacy is a multi-tenant SaaS platform, hosted in the EU, for building and maintaining a Record of Processing Activities in English and German.
Each processing activity is a guided record, section by section: purposes and legal basis, data categories, retention, recipients and systems, international transfers and security measures. For each field, the AI assistant proposes content drawn from the organisation’s context and states why. A person accepts or dismisses every suggestion.
A missing answer becomes a task assigned to a colleague, and the dashboard shows which records still need attention.
Values delivered by our team
Delivery
- Architecture and build across frontend, backend, database, authentication and infrastructure
- Domain-specific forms and workflows, reworked as product requirements changed
- Email notifications, monitoring, automated tests and CI/CD
AI assistant
- Field-by-field suggestions as structured outputs
- Suggestions drafted from each organisation’s own context
- Every suggestion accepted or dismissed by a person, with the reasoning shown
- Model provider behind a connector, replaceable at any time
Privacy by design
- Fail-closed allowlist that stops personal data leaving the tenant boundary
- EU hosting to meet data-residency requirements
Multi-tenancy
- Multi-tenant data model for separate customer environments
- Role-based access control per organisation
- Interface and records in English and German
Other engagements
Let's talk about your project.
Tell us about your goals and we will suggest the right approach and team to get you there.
Most projects can start in under a week.
- 1Tell us what you need
- 2Get a proposal with team, timelines and costs
- 3Start in under a week
We sign an NDA before discussing anything in detail. We reply within 24 hours.