Where your data goes — and where it doesn’t.
As of 4 October 2026
For your IT, your data protection officer and your works council: what Biwak logs, where it processes data, what is certified and what is still missing.
- Your computer Stays here Files, conversations and checkpoints, in ~/.biwak. Only what a task needs goes out.
- Biwak account · Frankfurt am Main Sign-in and usage Allowance and receipts. The database enforces deletion periods itself every night.
- Language model · EU Computes the answer All performance levels run on Microsoft Azure in the EU Data Zone; Microsoft commits to no training and no access by the model makers. If Azure declines a request, Prem AI processes it with partners in the EU. If neither can read an image, Scaleway in Paris reads it as a fallback.
2,280 m
Biwak does not rate people.
A tool that can monitor work on the computer is subject to co-determination by the works council (§ 87(1) no. 6 BetrVG, the German Works Constitution Act). That’s why this page sets out what Biwak logs — and what it expressly does not.
Logged
- The tasks users enter themselves
- Which files the agent read and changed
- The checkpoints before every change
- Time and usage of each model task
The tool log is stored locally. Time and usage of model tasks are stored in the Biwak account, for the allowance and billing.
Not collected
- Keystrokes, screen content, attendance
- Comparisons between employees
- Reports for managers
- Rankings by personal performance
Model works agreement for using Biwak in progress · on request
2,480 m
For review by your IT.
Your data protection officer’s questions — answered in advance, including where the answer today is “no”.
- Fulfilled:Fulfilled
- In progress:In progress
- No:No
- Detail
Data and operation
- Where conversations are stored ~/.biwak Stored locally; model context is transmitted.
- Account required Yes, for model tasks
- Usage data Allowances and billing For each model task: time, model and usage, in the Biwak account.
- Fulfilled: Outbound connections Model access via Biwak
- Processing locations Account: Frankfurt · Models: EU All performance levels run on Microsoft Azure in the EU Data Zone, with stored data in Germany. If Azure declines a request, Prem AI (PREM SA, Switzerland) processes it, forwarding to its compute partners Nebius and TensorX in the EU and the United Kingdom. If an image fails with both, Scaleway in Paris reads it as a fallback. Otherwise only app versions up to 0.2.24 and a previously saved model choice, which the slider shows as “Custom”, still run on Scaleway. The browser workspace runs on our server at Scaleway in Paris. Names and addresses: Privacy policy, section 14.
- Input at the model provider Not stored, not used for training Commitment by the providers in their documentation. Microsoft Azure: neither the model makers nor other customers have access, and the DPA ties processing to providing the service; suspicious requests may be stored for abuse monitoring and read by humans. Prem AI, as the fallback: contractual with its partners, without technical safeguards. Scaleway, for older app versions and the image fallback: up to two weeks for troubleshooting in the event of server errors. Privacy policy, section 14.
- Model operation Access managed by Biwak Sign in with your Biwak account.
- Deletion Local data and account data are deleted separately
Evidence and contracts
- Fulfilled: Storage limitation (Art. 5 GDPR) Automatic, every night IP address and email removed from download records after 30 days, the record deleted after 180 days. Privacy policy, section 10.
- Fulfilled: Data processing (Art. 28 GDPR) In place · ready to download Part of the terms and conditions for businesses, without a separate signature: the European Commission’s standard contractual clauses (Implementing Decision 2021/915) with our annexes. The agreement itself names the open points. Read · PDF (in German).
- Fulfilled: DPA with the model provider In place · Microsoft Microsoft’s data processing agreement, version of 22 May 2026: processing only on our instructions, requests from authorities are redirected to us and challenged, security incidents are reported without undue delay, new subprocessors are announced in advance. It does not contain an obligation under Section 203 of the German Criminal Code (StGB). For the fallback via Prem AI there is no signed DPA yet. Privacy policy, section 14.
- Fulfilled: Technical and organisational measures Annex III of the DPA Described, not certified; the annex itself states what is missing. Annex III (in German) · Places in the source code under Evidence.
- ISO 27001 — data centre Azure: audited annually according to the DPA In the DPA, Microsoft commits to security measures in line with ISO/IEC 27001, 27002 and 27018 and to annual audits by independent auditors; we have not yet filed the certificates themselves. For the fallback route via Prem AI and its compute partners Nebius and TensorX, we have no such commitment. Scaleway, as the operator, is certified to ISO/IEC 27001:2022, valid until 5 December 2026 — not Biwak; only older app versions and the image fallback still run there. Privacy policy, section 14.
- No: ISO 27001 · BSI C5 — Biwak Not certified We say so rather than hint at it.
- Headquarters and development Munich, Germany
- Operating system macOS 14+ · Windows 10+, 64-bit Apple Silicon and Intel. Linux on request.
- Fulfilled: Traceability Every step in the history
Product status 4 October 2026 · DPA ready to download · further documents on request
2,680 m
Three steps to your first task.
Open the app, sign in, start your first task. Model answers need an internet connection and a plan; to try it out, the one-off trial credits are enough.
- 1 Download and open An app in the “Applications” folder. Model access is provided through your Biwak account. 1 minute
- 2 Sign in to Biwak Biwak manages your model access. Check the available allowance in your account. 2 minutes
- 3 Choose a folder, write a task Biwak works in this folder and saves the results there. Before the first change, there is a checkpoint for the whole folder. Then you’re off
- Requirements
- macOS 14+, Apple Silicon or Intel · Windows 10+, 64-bit
- Outbound connections
- Biwak model access
- Where conversations are stored
- ~/.biwak, one file per conversation
3,040 m
What works, what’s coming, what isn’t.
The reason you can trust the rest of this page.
Fulfilled:Working today
- Tasks with file access on Mac and Windows
- Checkpoint before every change
- Permission levels from “Always ask” to “Full access”, from version 0.2.27
- Terminal commands and internet access can be switched off
- Model access through your Biwak account
- DPA based on the EU standard contractual clauses, as a PDF
- Day and night view
In progress:Coming next
- More features for company accounts
- Extended evidence on model operation
- The first training courses
No:Deliberately not
- Syncing your conversations with a cloud
- Autonomy without checkpoints
- Usage without a traceable receipt
- Performance rankings of employees
This status 4 October 2026 · rewritten as soon as it’s no longer accurate
What your IT usually asks first.
Where does my data go when I work with Biwak?
Files, conversations and checkpoints stay on your computer in ~/.biwak. For a model task, your input, the conversation context needed and the file contents used go via the Biwak relay in Frankfurt am Main to the language model. All performance levels compute at Microsoft Azure in the EU Data Zone; the contracting party is Microsoft Ireland. If Azure declines, Prem AI computes: the contracting party is PREM SA in Switzerland, and according to Prem, processing happens at Nebius and TensorX in the EU and the United Kingdom. If an image fails with both, Scaleway in Paris reads it as a fallback. Otherwise, only app versions up to 0.2.24 and a previously saved model choice, which the slider shows as “Custom”, still compute at Scaleway. Names and addresses are listed in section 14 of the privacy policy.
Can an employer use Biwak to monitor employees’ work?
Biwak does not collect keystrokes, screen content or attendance and offers no comparisons, reports for managers or rankings. What is logged: the tasks someone enters themselves, which files the agent read and changed, and the checkpoints; the tool log is stored locally. For the allowance and billing, the Biwak account also records the time and usage of each model task. From this you can tell when an account was used. A model works agreement is in progress; you can have it on request.
Is Biwak certified to ISO 27001 or BSI C5?
No, Biwak is not certified. Microsoft Azure, where all performance levels run first, commits in its data processing agreement to security measures in line with ISO/IEC 27001, 27002 and 27018 and to annual independent audits; we have not yet filed the certificates themselves. For Prem AI and its compute partners Nebius and TensorX, we have no such commitment. Scaleway, where only older app versions and the image fallback still run, is certified to ISO/IEC 27001:2022; the certificate is valid until 5 December 2026. Certification body and scope are listed in section 14 of the privacy policy.
How long does Biwak keep personal data?
The database enforces retention periods itself every night: IP address, browser identifier and email address from download records disappear after 30 days, the record itself after 180 days. Separate deletion routes and statutory retention periods apply to account and billing data; the overview is in section 10 of the privacy policy.
Is your IT missing a detail? Write to us — we reply in writing so you can pass it on.