Your deal data stays your deal data
Due diligence material is some of the most sensitive information a fund handles. So we say exactly what happens to it: where it is hosted, which models process it and where, and that we use it only to provide the service to you.
Hosted in Frankfurt. Kept apart per workspace. Never sold. Deleted when you ask.
Four facts, in plain words
Each one matches our Terms, Privacy Policy and Data Processing Agreement, so what you read here is what you sign.
-
European infrastructure
Hosted on AWS in Frankfurt. By default the language models run through Amazon Bedrock in the EU; some processing uses Anthropic’s models directly, in the United States.
-
A workspace of your own
Lab08 is one platform shared by all clients, and each workspace keeps its data apart: its own database schema, file storage bucket and knowledge graph, and its own AI agent runtime.
-
Our own method
The models are Anthropic’s Claude. The agent pipelines, question sets and evidence grading around them are ours - not a generic assistant wired to a prompt.
-
Used only to serve you
You own what you upload and what Lab08 produces for you. We use it only to provide the service, we never sell it, and we never use it for our own purposes.
Claude models, run through our method
Lab08 runs Anthropic’s Claude models inside agent pipelines we built around our diligence method. The reasoning behind a screening follows our framework - not a generic assistant's - and where your data is processed is written down in our privacy policy and DPA.
You own your material. We use it only to provide the service - never for our own purposes.
-
Built for diligence, not chat
Our agents are constrained by the Lab08 framework: fixed question sets, graded evidence and declared gaps.
-
A processing path on record
By default, inference runs on Amazon Bedrock in the EU. Anthropic’s models are used directly, in the US, for the AI agent in designated internal workspaces and any workspace set up to use them, and for code due diligence and email sorting.
-
Traceable output
Every conclusion carries its source and date, so you can audit what the model actually relied on.
-
No decisions made for you
Output informs your judgement. It is not investment advice, it can be wrong, and the decision is always yours.
European by default, separated by workspace
Built on AWS in Frankfurt. One platform serves every client, and your workspace keeps your data apart from theirs.
-
AWS in Frankfurt
Managed cloud infrastructure in the EU, with backup copies in other AWS EU regions.
-
Access on least privilege
Role-based access inside your workspace. On our side, production access is limited to named people, and each time staff act inside your workspace it is logged.
-
Encrypted in transit and at rest
TLS in transit, encryption at rest, secrets in AWS Secrets Manager, and tokens for connected accounts encrypted again by the application.
-
Links that expire
Files are served through links that expire after an hour, so a copied link stops working.
-
Deletion on request
Ask us to delete a company or your whole workspace and we do it without undue delay. Backups, logs and error reports follow the retention in our privacy policy.
-
Sub-processors on record
Our privacy policy and DPA name every sub-processor, and we email you 30 days before we add or replace one.
What you can decide, and undo
A screening needs no company access at all - public signals only. Everything beyond that is something you grant, and can withdraw.
-
Start with no access at all
An agentic screening uses only public signals. You get a full read without the target ever being contacted, and without uploading anything.
Access None
-
Share what one deal needs
Documents and data-room material are filed against one company in your workspace, and connected accounts such as Google can be disconnected at any time.
Access Scoped
-
Bring your own boundaries
If your fund has requirements on residency, retention or named personnel, tell us before we start. We say plainly what the platform does today, and put anything we agree in writing.
Access Your rules
-
Take it back
Disconnect a connection or ask us to delete data at any point. When you leave, we delete your workspace and confirm it in writing if you ask.
Access Revoked
Questions from your IT
or compliance team?
We are happy to walk through the architecture, the data flows and our processing terms in detail - before you put a single document anywhere near the platform.