Bodanean Averholm product

Bodane does not claim EU-only sub-processors. Here is what it does claim.

Averholm’s other product processes your clients’ personal data, and every one of its sub-processors is in the EU. Bodane is a different product with a different shape: what it analyses is published law — and, only if you choose, a few sentences describing your practice — and the analysis is done by a provider in the United States, because no EU processing region is available to us for it. Saying otherwise would be the easiest thing on this page and the only unforgivable one.

The boundary, in full.

Read the two columns against each other. Everything Bodane sends anywhere is on the left; everything that stays inside your deployment is on the right. There is no third category.

Leaves the deployment

Public law, and two things of yours

This is everything that is sent out:

  • The text of Luxembourg bills and the explanatory documents filed with them — the exposé des motifs and the commentaire des articles. All of it already published by the State. The fiche d’évaluation d’impact is not among them: its two useful fields are read inside the deployment, because 86% of first pages carry a named official’s direct line and e-mail address.
  • With the direct contact details of named officials removed first. Explanatory documents routinely carry a civil servant’s desk telephone number and e-mail address; there is no reason for those to travel.
  • Your practice description, if you write one. When you set up your topics you can describe your practice in a few sentences and have Bodane propose the practice areas that fit. That description goes to the same provider, to be classified against a fixed list — with e-mail addresses and telephone numbers removed, and nothing else about your firm added. The consent wording is shown immediately above the box, and your consent is recorded with the result. You can build your topics by hand instead, and then nothing of this kind is sent.
  • The e-mails Bodane sends you. Digests, alerts and sign-in links go out through an e-mail delivery provider. It carries what is in them and the address they go to, and does nothing else with them.
Sent toA commercial language-analysis provider in the United States — the bill text and the practice description, nothing else.
Why thereIt offers no EU processing region for this. That is a real constraint, not a preference, and we would rather state it than dress it.
StatusRunning 380 bills read so far. The bill reading is published legislative text and nothing else — no account, no topic list, no review decision reaches it. While that reading was being calibrated, a sample of the same bills was also read by two other providers in the United States, to check the first against them; that is not part of the running product, and nothing of any customer’s was in it.
Never leaves the deployment

Everything of yours

None of the following is sent to that provider in any form — not as a prompt, not as an example, not as training data — and none of it goes to anyone else, except inside the e-mails Bodane sends to you:

  • Your topic definitions. The keywords, ministries and directives that describe your practice are the most commercially revealing thing in the system. They are matched locally, against text, inside your deployment. A practice description, if you write one, comes back as practice areas from a fixed list; the topics you then keep and edit are never sent.
  • Your verdicts. What you marked relevant, and what you did not.
  • Your own documents. If you point Bodane at your template clauses and engagement letters, they are read inside the deployment for the provisions they cite, and the text is not kept. What is stored is the title you give the document, the list of provisions, one sentence of evidence for each, and a fingerprint that recognises the same file twice; none of it goes to the provider, and none of it can be turned back into the document. One exception, and it is temporary: while you work on a prospectus amendment, the prospectus’s structure — its headings, paragraphs and table cells — is kept so the questions can be built from it, and it is deleted when you finish, when you delete the amendment, or after thirty days.
  • Any client data. Bodane never asks for it, and nothing in it needs a client’s name. What you type into free text is kept as you typed it, though — a document title, a practice description — so keep client names out of those, and out of the practice description above all, because that is the one that leaves.
  • Your users. Accounts, sign-ins, what anyone looked at and when.
ConsequenceThe bill reading tells the provider nothing about who is interested in which law: each bill is read once, for everyone. The one thing of yours it can see is a practice description, and only if you write one.

The analysis is performed on the corpus, not per customer: a bill is read once and the result is available to every deployment. A firm’s topics are then matched against that reading locally. Which is both cheaper and the reason the topic definitions never need to travel.

Where it runs is a choice, not a tier.

Bodane runs on our infrastructure or on yours. Same product, same features, same price. Nothing is withheld from the self-hosted build to make the hosted one look better — that trick is how self-hosting usually gets sold, and it is why nobody trusts it.

On our infrastructure

Hosted in the EU

We run it, we keep it current, you log in. The deployment and its database are in the European Union.

You getNothing to operate. Updates as they land.
Trade-offYour topics and verdicts sit in a system we operate rather than one you operate, under a data-processing agreement, signed with each firm before any of its data goes in. Ours is being drafted, and we will go through it with your DPO.
On yours

Inside your own walls

The same application, installed on infrastructure you control. We never see your topics, your verdicts or your users, because there is nowhere for them to reach us from.

You getFull control of the data, and the ability to switch off both steps that use the outside provider — the bill reading and the practice description. Then nothing leaves your network except the e-mails, through a mail server of your choosing, and Bodane runs on titles, ministries, bill types, transpositions, and the acts, regulations and articles a text cites. Any templates you point it at never leave your network either.
Trade-offYou operate it, and you apply the updates.

The legislative data is not ours, and the licence has terms.

Luxembourg publishes its legislative register as open data under the Creative Commons Attribution 4.0 licence. That licence permits everything Bodane does with it — copying, storing, analysing and showing it to you — on one condition: attribution.

So the attribution is not a courtesy line in a footer we hope you overlook. It appears next to legislative content wherever that content appears, on this site and in the product, and it names the source exactly as the licence requires.

Source: Légilux, Service central de législation, Ministère d’État — licensed CC BY 4.0. the line the licence requireson every page showing legislative content

Bodane is not affiliated with, endorsed by, or acting for the Grand Duchy of Luxembourg. Reproducing the State’s published texts under an open licence does not make us a source of law; the register is.

And this website.

The easiest place to catch a compliance vendor contradicting itself is its own marketing site. Open the network tab while you read this one.

Bring your DPO to the conversation.

This page is the short version. If your firm needs the long one — the draft processing agreement, the retention rules, the exact redaction — ask, and we will go through it line by line rather than sending a brochure.

See a demo