Questions we get asked
The three that come up in almost every first conversation: whether the code is open, what happens to your data when AI is involved, and how we know what we know.
Is it open source?
Most of our products could be considered open source — but not free for all. The source can be shared with a customer, depending on the product: for audit, for modifications of your own, or for shared development where that makes sense. What we are not doing, at this stage, is keeping the repositories open on GitHub or any other public host.
We are open to discussion about it, and we are not ruling out publishing some of the repositories eventually. The tools with no customer-specific knowledge in them are the obvious candidates. If access to the source matters for your decision, say so; it is a normal part of the conversation.
GDPR and AI: where does the data go?
Only nConnect sends anything to a language model, and it sends it to the provider you configure. Nothing else we ship — Message Gateway, Campaign Workbench, EmailRelay, the Scheduler, the SQL tools — uses AI at all. So the question is really about which model provider a collection agency can use, and what each one does with a prompt that contains case data. This is our reading of the providers' own documentation as of September 2026; it is not legal advice, and it does not replace your own assessment.
Microsoft (Azure OpenAI and Microsoft Foundry)
Microsoft's terms for the models it sells on Azure are clear on the two things people ask first. Prompts and completions are not used to train any model and are not available to OpenAI or the other model providers. And with a regional or an EU data zone deployment, prompts are processed within the EU, and anything stored at rest stays in the Azure geography you chose. Reviewers who look at prompts flagged by abuse monitoring are, for EEA deployments, located in the EEA.
Three details are easy to get wrong, and each one moves data further than intended:
- Deployment type. A Global deployment may process prompts in any geography where the model runs. Pick a regional deployment (Sweden Central, for instance) or the EU data zone, and use Azure Policy so nobody can create a Global one by accident.
- Abuse monitoring. By default, prompts flagged by the automated checks may be stored for human review by Microsoft employees. Organisations that need that storage and review switched off can apply for modified abuse monitoring; it is an application under Microsoft's Limited Access rules, not a setting.
- Third-party models. Microsoft's own documentation notes that when Anthropic models are used through its generative AI services, customer data is processed by Anthropic in the United States even though it is stored in the EU. An EU data zone does not cover every model in the catalogue.
Is an AI call different from storing the same data in Teams or OneDrive? Not in
any way that matters legally. Both sit inside Microsoft's EU Data Boundary under the same
Data Protection Addendum. That boundary is real, and it has documented exceptions that apply to
every service in it: limited data is transferred outside the EU for global security operations,
engineers outside the EU may be granted remote access to repair a service, and directory data is
replicated worldwide. Above all, Microsoft is a US company. On 10 June 2025 the rapporteur of a French
Senate inquiry asked Microsoft France's director of public and legal affairs, under oath, whether
he could guarantee that data entrusted to Microsoft by French citizens would never be handed over
following a US government order without the explicit consent of the French authorities. The
answer, from the official record: Non, je ne peux pas le garantir, mais, encore une
fois, cela ne s'est encore jamais produit.
— No, I cannot guarantee it, but, once again,
it has never happened yet. That answer applies equally to a mailbox, a document and a
prompt. If your organisation has
already accepted Microsoft 365, an Azure model in the EU data zone is the same decision made
once more — provided it is configured as above.
The safer options
Two configurations take the US question off the table, and nConnect supports both.
- A European provider. Scaleway's Generative APIs run in France, under a French company, on European infrastructure. Scaleway states that it does not use prompts or outputs for training and applies zero data retention by default. It offers the open-weight models — Llama, Mistral, Qwen and others — which is what most of the work in a collection system needs.
- Your own server. Run the model on a machine you own, with Ollama or a similar server, and nothing leaves your network. The hardware for a capable open-weight model is a single GPU server. nConnect's knowledge-base search already works this way regardless of the model you choose: the embeddings are computed locally and never sent anywhere.
Whichever you choose, the rest is ordinary GDPR hygiene, and it is worth writing down: a data processing agreement with the provider, a data-protection impact assessment for the use case, and a note of which cases an agent may read. nConnect's approval gate, per-system access rules and audit log exist to make that last point enforceable rather than aspirational.
References
Every claim above comes from the provider's own documentation or from the public record. Read them yourself before deciding; they change, and we last checked them in September 2026.
- Data, privacy, and security for Foundry Models sold by Azure — Microsoft Learn. No training on prompts; processing within the chosen geography or data zone; data at rest stays in the geography; reviewers for EEA deployments are in the EEA.
- Abuse monitoring — Microsoft Learn. What is flagged, automated and human review, and how to apply for modified abuse monitoring.
- Deployment types — Microsoft Learn. Global, Data Zone and regional deployments, and where each may process a prompt.
- What is the EU Data Boundary? and Continuing data transfers that apply to all EU Data Boundary services — Microsoft Learn. The boundary covers Microsoft 365, Azure, Dynamics 365 and Power Platform alike; the second page lists the transfers that continue regardless — security operations, remote access by engineers, directory data — and states that Anthropic models used through Microsoft's generative AI services process customer data in the United States.
- Microsoft Products and Services Data Protection Addendum — the contract that governs both a Teams tenant and a Foundry resource.
- Sénat, commission d'enquête sur la commande publique — compte rendu de la semaine du 9 juin 2025 (video of the hearing) — the official record of Microsoft France's testimony on 10 June 2025, in French. English coverage: The Register and heise online.
- Scaleway Generative APIs — data privacy — Scaleway's own statement on training, retention and where inference runs.
How do you know all this? Do you have the source code?
No. We do not have the source code for Nova or for Aptic. Daniel worked as a developer on both systems, many years ago, and that gives a certain feel for how they are put together — but system development moves fast, and that kind of inside knowledge goes out of date even faster. What actually carries the weight today is a long time working with both systems from the outside, and the habit of finding out how they behave: by testing, by watching the SQL they exchange with the database, and by looking inside the binaries where the documentation stops. Large language models have made that kind of work far more productive than it used to be. It is how the knowledge hub was written, and how a product like EmailRelay can use the same tables as the service it replaces.
So we cannot guarantee that everything we publish is accurate, or that it is at the level the vendors themselves could provide. Tietoevry and Aptic know their systems in a way an outsider never will. Where we are wrong, we want to hear about it, and we correct it.
We are not trying to compete with them. We fill gaps. If Tietoevry or Aptic offered products with the features we provide, customers would choose their system vendor any day of the week — and they should. That is why we never ask for a long-term contract: a customer can switch from our solution to the standard feature on the flip of a coin, whenever they like, and we encourage it. We are always ready to step back. What we want is that our customers can do their work as well as possible, and for as long as we are the ones making that easier, we would like to keep doing it.