If you are considering Alethexis — or any tool that will process your company's data — the reasonable question is whether the provider practises what it preaches. This page is a record, not a sales pitch: four practices Alethexis applies to itself, the public evidence that lets anyone check them, the figures recounted on 12 September 2026, and what remains open. It is the same standard we argue for any governance claim: with its evidence it is a fact; without it, an opinion.
The record, in one table
| Practice | What we do | Where it shows | How we checked it |
|---|---|---|---|
| No visitor analytics, no pixels | The site loads no audience analytics and no third-party pixels | Cookie policy | No measurement script in the HTML or in the code the site serves (checked on 26 September 2026) |
| A trial without a card | Sign-up with email and password, or with Google; the 14-day trial starts when setup is finished, with no payment method | Pricing | The sign-up form has no payment field, and starting the trial does not go through the payment gateway |
| Data in the EU, with row-level isolation | Database and storage in Frankfurt; row-level security on every table | Security · Sub-processors | Region eu-central-1; RLS on 80 of 80 tables, with 191 policies |
| Integrity hash, not signature | Every generated PDF records its SHA-256 hash; there is no electronic signature | Security | The hash table does not allow records to be changed or deleted |
No visitor analytics, one week in which there were, and a loose end that was closed
The site loads no audience measurement tools and no third-party conversion pixels, and the cookie policy says so: there are no visitor analytics and, for that reason, no consent banner to show. No page loads a measurement script today: we checked on 26 September, in the HTML and in the code the site serves. A policy that says "we don't do analytics" next to a script that asks for it would be a contradiction anyone could see in their browser.
It was not always so, and a record says it. Vercel's Web Analytics feature was enabled on the project from 31 August to 26 September 2026, and data was collected from 31 August to 7 September: the site mounted that component, which counts page views without cookies, until it was removed on 7 September; the feature was switched off in the dashboard on 26 September. When we wrote this record, Vercel's query API returned "Web Analytics not found" and we read it as the feature not being enabled. It did not show that: a query that finds no data says nothing about the state of a switch. The provider keeps that week's data according to its retention period; the deletion request will be noted here with its date.
There was also one loose end, which this record noted on 13 September instead of leaving it out: the site mounted Speed Insights, another Vercel product that measures page performance — how long pages take to load — not who visits them, and the cookie policy did not mention it. Two options were written down: remove it or declare it. Closed on 26 September 2026 with the first: the component was removed from the site, so no page sends those metrics any more. The product still shows as enabled on the Vercel project and the dashboard offers no way to switch it off; what we did check is that no page loads its script any more.
A trial that does not ask for a card
Trying Alethexis does not require a card. The sign-up form asks for an email address, a password and acceptance of the terms; you can also sign in with Google. The 14-day trial starts when the initial account setup is finished, and the code that starts it does not touch the payment gateway: it writes the trial status and the date it ends.
What is requested, afterwards and during that setup, are the organisation's details — legal name, sector and size — because they configure the account. The tax ID is optional at that step: it is only required when subscribing, before the payment is created. It is a design decision that sums up all four: ask for each piece of data where it is needed, and not before.
Data in Frankfurt, with row-level isolation
The product's database and storage are in Supabase's eu-central-1 region, in Frankfurt; on 12 September 2026 the project's own API confirmed it. Isolation between customers does not depend on the code remembering to filter: the database does it, with row-level security (RLS). On that day, all 80 tables in the main schema had it enabled, with 191 policies. And it goes back a long way: the migration that created the Alethexis schema defines 35 tables and enables RLS on all 35.
Data in the EU does not mean that nothing leaves the EU, and it is worth saying so just as clearly: there are sub-processors with international transfers, covered by standard contractual clauses and, where applicable, by the EU-US Data Privacy Framework. The list is public on the sub-processors page, and the security page details the measures. When Alethexis processes data on a customer's behalf it is its processor within the meaning of Article 28 GDPR, and the DPA sets out what that article requires the contract to contain. It is the same thing worth asking of any AI vendor.
Integrity hash, not signature
Every PDF the product generates — the use policy, the governance minutes, the responsibility matrix, the FRIA, the DPIA and the agent inventory — records its SHA-256 hash when it is generated. As of 12 September 2026 there were 31 hashes recorded, across those six document types. The hash makes it possible to check that a document has not changed since it was generated; it identifies no one and is not an electronic signature, which the product does not have.
That is why we no longer call it a signature. We corrected it in the interface, the specification and the documentation, because "signature" invokes the legal regime for electronic signatures, whose requirements the product does not meet. The table that stores the hashes keeps its inherited technical name, but the database does not allow its records to be changed or deleted.
What this record is not
It is not an external audit and does not replace one. The DPA gives customers the right to audit Alethexis's compliance, and the record of processing activities required by Article 30 GDPR exists and is kept up to date. What this page does is more modest and easier to check: it sets out four facts, with the public evidence and the date they were checked. If any of them stops being true, the page is revised, just as a classification expires when the law changes.
Nor is it a sales argument. It compares Alethexis with no one and promises nothing about what a customer will achieve. There are things no system does for you — nor for us — and where that boundary lies is covered separately.
What can be copied
The method is not exclusive to a software vendor. Any SME can draw up its own record with three rules:
- Every claim, with its evidence. "We don't put customer data into personal tools" is worth what the record proving it is worth.
- Every piece of evidence, with its date. What was checked in September says little about December if nobody looks again.
- What is open, written down. A loose end on record is governance; a hidden one is a risk someone will find before you do.
Who is behind Alethexis, on the company page; and the summary of all this, on Trust.
Content in accordance with Articles 4, 28, 30 and 44 of Regulation (EU) 2016/679. Figures recounted on 12 September 2026; the query is in the product repository.
This article is for informational purposes only and does not constitute legal advice.