Your repo stays local
Your copilot holds the repository. Only the part a request needs crosses to Pauhu. The repository never leaves your tool.
Trust and compliance
Made to be reviewed.
One place for procurement, security, and legal: where data lives, who processes it, how EU law applies, and why the compiler is not an AI system.
EU processing
The work runs in the European Union (Hetzner, Helsinki). The one processor outside the EU is the payment provider, disclosed in full in the DPA.
Not an AI system
The compiler does not learn from, profile, or make automated decisions about your developers. The imprint records that it is not an AI system under Regulation (EU) 2024/1689.
Scoped, rotatable access
Access is by an API key you control, sent as a Bearer header over TLS. Keep it confidential; we rotate it on request or on any suspected leak.
No third-party scripts
This site loads only from pauhu.dev. No analytics SaaS, no third-party trackers, no external embeds.
Auditable by design
The same request gives the same result, so a security review can reproduce and stand behind what the tool returns.
Sub-processors and transfers
Disclosed in full.
The work happens in the EU. The only transfer to a third country is to the payment provider, under the EU Standard Contractual Clauses. The DPA carries the authoritative list.
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting and processing | Helsinki, Finland (EU) |
| Stripe, Inc. | Payment processing | USA (SCCs / EU-US DPF) |
Documents
The legal set, in one place.
GDPR bases (contract, legitimate interest, legal obligation), retention periods, and your rights are in the Privacy Policy. To request or sign the DPA, email hello@pauhu.ai.
Policies
Good to know
- SOC 2 / ISO 27001 attestations are not published today; we follow GDPR and apply technical and organisational measures.
- No published uptime SLA yet; live status is on the Community page.
- Request the DPA or a security questionnaire at hello@pauhu.ai.