Compliance & Security
Researchers trust Kahubi with unpublished work and participant data. Here is exactly how we handle it, in plain language.
A European company, under European law
Kahubi is built and operated by Avidemic AB, a company registered in Sweden and supervised by the Swedish data protection authority (IMY). That means your relationship with us is governed by EU law from end to end: the GDPR applies not as a policy we adopted, but as the law we are incorporated under.
Kahubi runs on servers in Sweden, and we select subprocessors that are GDPR-compliant and European: hosting in Swedish data centres with backups in the EU, AI models run in Ireland, France and Sweden on EU infrastructure, transcription runs in Germany, Sweden and France, transactional email in the Netherlands on EU-only infrastructure, and our analytics is self-hosted on our own EU servers. Avidemic builds AI software for research and clinical work, and its products are used at universities, research institutes, and hospitals across Europe, environments where confidentiality and ethics-board scrutiny are the norm, not the exception. We build to that standard for every account.
Never used to train models
Your papers, unpublished manuscripts, datasets, and interview recordings are used exclusively to fulfill your requests. We do not train AI models on your content, and our AI subprocessors are used via API agreements that exclude training on customer data.
GDPR-compliant by design
Kahubi is operated by Avidemic AB, a Swedish company subject to the GDPR. We collect only what the service needs, document our subprocessors below, and act on data-subject requests: access, correction, export, and erasure.
EU processing for transcription
Interview audio and video are transcribed by European providers, Lemonfox (Germany, EU endpoint), Berget AI (Sweden) and Gladia (France), so recordings of research participants are processed within the European Union. That is a hard requirement for many ethics approvals, and a default in Kahubi.
Encrypted credentials at rest
Integration tokens (Zotero, Mendeley, GitHub) are encrypted at rest with application-level encryption and displayed only in masked form after you save them.
Private by default
Your Kahubi account profile and research content are private and never shared without your consent. There are no ads, and we never sell your data.
Deletion on request
You can export your library (BibTeX, RIS, CSL-JSON) and your manuscripts (.tex, .docx, PDF) at any time. Request account deletion and we remove your account and associated content from our systems, confirming when it is done.
Subprocessors
We use a small, documented set of GDPR-compliant subprocessors, each limited to a single purpose and bound by a data processing agreement. Your content is shared with them only to the extent required to deliver the feature you are using.
For institutional customers (invoice billing), every subprocessor is a European company processing data in the EU.
| Provider | Purpose | Notes |
|---|---|---|
| Hosting | ||
| 🇪🇺Hostup AB (Sweden) | Primary hosting: the servers that run Kahubi and store your account, library, and project data | Swedish company; data centres in Sweden |
| AI models | ||
| 🇪🇺Primary: TensorX (Ireland). Backup: GreenPT (Netherlands), Inceptron (Sweden), Berget AI (Sweden), Scaleway (France) | AI text generation and analysis (chat, writing, statistics interpretation), vision, and semantic search embeddings. The backup providers add capacity when the primary is unavailable and offer optional alternative models | European companies running open-source models in EU data centres (Ireland, France, Sweden). Your content is never used for model training |
| Transcription | ||
| 🇪🇺Lemonfox (Germany) / Berget AI (Sweden) / Gladia (France) | Speech-to-text transcription of interview audio/video (speaker labels) and voice notes; Gladia only for optional PII redaction | European companies; processed in the European Union |
| Web search | ||
| 🇪🇺Staan (France) | Web search when the assistant searches the web on your request (receives the search query only) | European search index (Qwant/Ecosia joint venture); EU jurisdiction and data centres |
| BillingOne or the other, never both: institutions are invoiced through Visma, self-serve accounts pay by card through Stripe. Which one applies depends on how you buy. | ||
| 🇪🇺Visma (Sweden) | Invoicing for universities and institutional buyers | Swedish provider. Institutional purchases are billed by invoice through Visma; card networks are never involved for institutional buyers |
| Stripe | Payment processing for credit card purchases (self-serve accounts only; not applicable to institutional buyers) | Card details go directly to Stripe (PCI-DSS Level 1) and never touch our servers; we contract with Stripe Payments Europe Ltd (Ireland) |
| 🇪🇺Lettermint (Netherlands) | Transactional email (verification, invitations, support replies) | European company; EU-only infrastructure. Email metadata only; no research content is sent by email |
| Network and security | ||
| 🇪🇺Bunny (Slovenia) | Content delivery, DNS and protection against cyber-attacks. Also provides redundancy: encrypted backup hosting and storage so your data survives a hosting failure | European company (BunnyWay d.o.o.); EU data centres only: Stockholm, Sweden, with redundancy in Germany |
Changes to subprocessors
We announce any new or replaced subprocessor on this page before it starts processing personal data, with its name, purpose, the categories of personal data and where processing takes place. For hosting and storage providers we give at least 30 days' notice. Customers with a DPA can object within 14 days on reasonable data protection grounds; if we cannot find a solution together, they may end the agreement without penalty.
If we must replace a subprocessor urgently, for example for security reasons, we only use providers established in the EU/EEA that process data within the EU/EEA and comply with the GDPR, and we announce the change within five working days.
To be notified by email when this list changes, write to team@kahubi.com with the subject “Subprocessor updates”.
Data Processing Agreement
Our standard DPA covers all of the above and lists these subprocessors in its Annex 1. Download the DPA (PDF, October 2026). For a signed copy or special provisions, contact team@kahubi.com.
Security contact
Found a vulnerability, or need a Data Processing Agreement, subprocessor notifications, or answers for your institution's ethics board? Write to us at team@kahubi.com and we will respond promptly. Please include enough detail for us to reproduce or assess the issue.
Compliance questions answered, work to do
Start on the free plan. Your data is handled the same way on every tier.