If you are considering Alethexis — or any tool that will process your company's data — the reasonable question is whether the provider practises what it preaches. This page is a record, not a sales pitch: four practices Alethexis applies to itself, the public evidence that lets anyone check them, the figures recounted on 12 September 2026, and what remains open. It is the same standard we argue for any governance claim: with its evidence it is a fact; without it, an opinion.
The record, in one table
| Practice | What we do | Where it shows | How we checked it |
|---|---|---|---|
| No visitor analytics, no pixels | The site loads no audience analytics and no third-party pixels | Cookie policy | Vercel's Web Analytics API returns "not found" for the project |
| A trial without a card | Sign-up with email and password, or with Google; the 14-day trial starts when setup is finished, with no payment method | Pricing | The sign-up form has no payment field, and starting the trial does not go through the payment gateway |
| Data in the EU, with row-level isolation | Database and storage in Frankfurt; row-level security on every table | Security · Sub-processors | Region eu-central-1; RLS on 80 of 80 tables, with 191 policies |
| Integrity hash, not signature | Every generated PDF records its SHA-256 hash; there is no electronic signature | Security | The hash table does not allow records to be changed or deleted |
No visitor analytics, and one loose end
The site loads no audience measurement tools and no third-party conversion pixels, and the cookie policy says so: there are no visitor analytics and, for that reason, no consent banner to show. This is not a statement of intent. The Vercel Web Analytics component was removed in September 2026, once it was found that the product was not even enabled on the project, and Vercel's API still confirms it: on 12 September it returned "Web Analytics not found". A policy that says "we don't do analytics" next to a script that asks for it would be a contradiction anyone could see in their browser.
And there is one loose end, which a record notes instead of leaving out: the site mounts Speed Insights, another Vercel product that measures page performance — how long pages take to load — not who visits them. We have not been able to measure from the outside whether it is enabled, and the cookie policy does not mention it. It is noted for a decision on whether to remove it or declare it, with both options written down.
A trial that does not ask for a card
Trying Alethexis does not require a card. The sign-up form asks for an email address, a password and acceptance of the terms; you can also sign in with Google. The 14-day trial starts when the initial account setup is finished, and the code that starts it does not touch the payment gateway: it writes the trial status and the date it ends.
What is requested, afterwards and during that setup, are the organisation's details — legal name, sector and size — because they configure the account. The tax ID is optional at that step: it is only required when subscribing, before the payment is created. It is a design decision that sums up all four: ask for each piece of data where it is needed, and not before.
Data in Frankfurt, with row-level isolation
The product's database and storage are in Supabase's eu-central-1 region, in Frankfurt; on 12 September 2026 the project's own API confirmed it. Isolation between customers does not depend on the code remembering to filter: the database does it, with row-level security (RLS). On that day, all 80 tables in the main schema had it enabled, with 191 policies. And it goes back a long way: the migration that created the Alethexis schema defines 35 tables and enables RLS on all 35.
Data in the EU does not mean that nothing leaves the EU, and it is worth saying so just as clearly: there are sub-processors with international transfers, covered by standard contractual clauses and, where applicable, by the EU-US Data Privacy Framework. The list is public on the sub-processors page, and the security page details the measures. When Alethexis processes data on a customer's behalf it is its processor within the meaning of Article 28 GDPR, and the DPA sets out what that article requires the contract to contain. It is the same thing worth asking of any AI vendor.
Integrity hash, not signature
Every PDF the product generates — the use policy, the governance minutes, the responsibility matrix, the FRIA, the DPIA and the agent inventory — records its SHA-256 hash when it is generated. As of 12 September 2026 there were 31 hashes recorded, across those six document types. The hash makes it possible to check that a document has not changed since it was generated; it identifies no one and is not an electronic signature, which the product does not have.
That is why we no longer call it a signature. We corrected it in the interface, the specification and the documentation, because "signature" invokes the legal regime for electronic signatures, whose requirements the product does not meet. The table that stores the hashes keeps its inherited technical name, but the database does not allow its records to be changed or deleted.
What this record is not
It is not an external audit and does not replace one. The DPA gives customers the right to audit Alethexis's compliance, and the record of processing activities required by Article 30 GDPR exists and is kept up to date. What this page does is more modest and easier to check: it sets out four facts, with the public evidence and the date they were checked. If any of them stops being true, the page is revised, just as a classification expires when the law changes.
Nor is it a sales argument. It compares Alethexis with no one and promises nothing about what a customer will achieve. There are things no system does for you — nor for us — and where that boundary lies is covered separately.
What can be copied
The method is not exclusive to a software vendor. Any SME can draw up its own record with three rules:
- Every claim, with its evidence. "We don't put customer data into personal tools" is worth what the record proving it is worth.
- Every piece of evidence, with its date. What was checked in September says little about December if nobody looks again.
- What is open, written down. A loose end on record is governance; a hidden one is a risk someone will find before you do.
Who is behind Alethexis, on the company page; and the summary of all this, on Trust.
Content in accordance with Articles 4, 28, 30 and 44 of Regulation (EU) 2016/679. Figures recounted on 12 September 2026; the query is in the product repository.
This article is for informational purposes only and does not constitute legal advice.