Private, secure AI · Luxembourg
Bestlog builds AI into your processes using one of two architectures, chosen to fit your constraints: models deployed on your own infrastructure or on European GPU servers, or an external AI service fronted by a layer that detects, filters and pseudonymises your sensitive data.
Architectures
The choice depends on how sensitive the data is, the quality you need, your infrastructure and your operating capacity. We decide it with you, case by case.
The data processed stays on the infrastructure you have chosen. For data you do not want to entrust to any external AI provider.
For tasks that need the most capable models available through an API. Before each call, sensitive data is detected, filtered or pseudonymised.
Please note
Pseudonymised data is still personal data under the GDPR. The protection reduces exposure; it does not remove the need for a contract with the AI provider, nor for your DPO's assessment.
Pseudonymisation remains a useful measure: the GDPR lists it among appropriate security measures (Article 32) and among the means of implementing data protection by design (Article 25).
Who it is for
Fiduciaries, audit firms, professional firms, insurers, associations and federations: for your internal processes and your dealings with third parties.
Bring AI into the existing information system without multiplying uncontrolled outbound data flows.
Know which data leaves, where it goes, and be able to show it from the logs.
Have a documented architecture for the record of processing activities and, where required, the impact assessment.
Cut repetitive tasks while keeping a human validation on every decision.
Use cases
Three examples of use cases that could be explored as a limited pilot, with results assessed on your processes and your data.
A suggested general ledger account and VAT code for each PDF invoice, with its rationale. Validation stays human.
Read the example →Emails from suppliers, customers or service providers classified by topic, with a suggested destination to confirm.
Read the example →Detection and masking of one type of sensitive data before each call to a defined AI API.
Read the example →Offers
Pricing on quotation only, after a first conversation.
The audit is neither legal advice nor a compliance certification. It prepares the work of your DPO and your advisers.
Request a flash audit →The duration depends on the agreed scope, data availability and technical prerequisites.
Discuss a POC →Method
One process, one user, one expected result. Measurement criteria are written before the first line of code.
Nature, sensitivity, volume, access. This is what decides the architecture.
Integration with your systems, authentication, logging, human validation wherever it is needed.
Results assessed on your real cases, with their limits. You decide on facts.
Case study
In BestDocSolution, a product developed by Bestlog, publications are automatically converted to audio by an AI running on a GPU server in Europe, with no call to an external AI API for this processing.
GDPR and AI Act
AI Act milestones
The AI Act transparency obligations (Article 50) have applied since 2 August 2026, with transitional provisions for certain generative systems placed on the market before that date. Obligations for high-risk systems listed in Annex III apply from 2 December 2027; those for systems embedded in products covered by Annex I, from 2 August 2028. The obligations that actually apply depend on the nature of the system, how it is used, and your organisation's role (provider, deployer…).
A first conversation to clarify the process, the data and the constraints.