Your deal data stays your deal data
Due diligence material is among the most sensitive information a fund will ever share. Lab08 is built around that fact: European hosting, strict separation between clients, and a simple promise that your data is used to serve you and nothing else.
Hosted in Frankfurt. Kept apart per workspace. Never sold. Deleted when you ask.
Four facts, in plain words
Each one matches our Terms, Privacy Policy and Data Processing Agreement, so what you read here is what you sign.
-
European infrastructure
Your data lives on AWS in Frankfurt, and our language models run through Amazon Bedrock in the EU.
-
A workspace of your own
Lab08 is one platform shared by all clients, and each workspace keeps its data apart: its own database schema, file storage bucket and knowledge graph, and its own AI agent runtime.
-
Our own method
The intelligence behind Lab08 lives in our diligence method (agent pipelines, question sets and evidence grading), not in a single AI vendor.
-
Used only to serve you
You own what you upload and what Lab08 produces for you. We use it only to provide the service, we never sell it, and we never use it for our own purposes.
Frontier models, run on our terms
Lab08 isn’t tied to any single AI provider. Our diligence method sits above the language model, so we can adopt the strongest model for each task as the field evolves. Your process and your data protections stay the same.
Your material works for your deal. Not for us, and not for anyone else.
-
Built for diligence, not chat
Our agents are constrained by the Lab08 framework: fixed question sets, graded evidence and declared gaps.
-
Controlled processing path
We decide where inference runs: in the EU on Amazon Bedrock, and only ever under business terms - never through a consumer AI app.
-
Traceable output
Each finding carries its source and date, so you can see exactly what the analysis relied on.
-
What’s yours stays yours
Every workspace runs in isolation, with its own database schema, file storage and knowledge graph. Your findings inform your screenings and no one else’s.
European by design, separated by workspace
Built on AWS in Frankfurt. One platform serves every client, and your workspace keeps your data apart from theirs.
-
AWS in Frankfurt
Managed cloud infrastructure in the EU, with backup copies in other AWS EU regions.
-
Least-privilege access
Role-based permissions inside your workspace. Production access is restricted to named team members.
-
Encrypted in transit and at rest
TLS in transit, encryption at rest, secrets in AWS Secrets Manager, and tokens for connected accounts encrypted again by the application.
-
Links that expire
Files are served through links that expire after an hour, so a copied link stops working.
-
Deletion on request
Ask us to delete a company or your whole workspace and we do it without undue delay. Backups, logs and error reports follow the retention in our privacy policy.
-
Sub-processors on record
Our privacy policy and DPA name every sub-processor, and we email you 30 days before we add or replace one.
What you can decide, and undo
A screening needs no company access at all - public signals only. Everything beyond that is something you grant, and can withdraw.
-
Start with no access at all
An agentic screening uses only public signals. You get a full read without the target ever being contacted, and without uploading anything.
Access None
-
Share what one deal needs
Documents and data-room material are filed against one company in your workspace, and connected accounts such as Google can be disconnected at any time.
Access Scoped
-
Bring your own boundaries
If your fund has requirements on residency, retention or named personnel, tell us before we start. We say plainly what the platform does today, and put anything we agree in writing.
Access Your rules
-
Take it back
Disconnect a connection or ask us to delete data at any point. When you leave, we delete your workspace and confirm it in writing if you ask.
Access Revoked
Questions from your IT
or compliance team?
We are happy to walk through the architecture, the data flows and our processing terms in detail - before you put a single document anywhere near the platform.