Data and switching

Ai11 Consulting GmbH / ONE / ai11one.com

Version: 9 November 2026

This page gives the information required by clauses 13.9 and 13.12 of our terms and by Articles 26 and 28 of Regulation (EU) 2023/2854 (the Data Act), and the list of our sub-processors under clause 5.4 of the data processing agreement (DPA). Your rights are governed by the terms and the DPA.

1. How to switch

• You can ask us in text form at office@ai11.io to switch to another provider, to transfer your data to your own IT environment, or to end the service and delete your data (terms, clause 13.5).
• The notice period before the transition starts is at most two months. The transition period is at most 30 calendar days; if that is technically not possible, clause 13.6 applies.
• After the contract ends you can retrieve your data for at least 30 calendar days (clause 13.2). Deletion follows clause 13.3.
• We charge no switching fees for the services the law requires for switching or for the data transfer (clause 13.10).

2. Export routes and formats

Logical backup

Content: all tables of your instance listed in section 4
Format: ZIP archive with one JSON file per table and a manifest.json file stating the format and schema version
Standards: JSON, ZIP
Access: by an administrator with the backup permission and a recent multi-factor sign-in

Files

Content: uploaded documents and attachments
Format: their original format
Access: provided on request to office@ai11.io (clause 13.2)

Individual exports

Timesheets and leave: Excel (XLSX) and PDF. Invoices, quotes and contracts: PDF. Deals: CSV.

Interface

Type: REST interface over HTTPS with JSON
Description: OpenAPI. For a switch we provide it to you and the new provider free of charge (clause 13.9).

3. Known limitations

• Uploaded files are not part of the logical backup. We provide them on request.
• The interface documentation is not public. For a switch you receive it on request.
• Where intellectual property rights or trade secrets stand in the way, the categories in clause 13.8 cannot be transferred, such as the program code of ONE and internal operating and security data.
• Integration with the new provider or in your own environment lies with you and the new provider, unless agreed otherwise (clause 13.7).

4. Register of data structures

The logical backup contains the following tables, each as its own file named after the table with the extension .json. Tables of modules your instance does not use are empty. Internal control tables for the backup, event delivery and load limiting are not included.

Accounts, roles and organisation

auth_challenges, auth_rate_limits, auth_sessions, consents, deletion_requests, employee_roles, employees, eula_acceptances, instance_licenses, integration_settings, mcp_oauth_authorization_codes, mcp_oauth_clients, mcp_oauth_refresh_tokens, mfa_recovery_codes, notification_preferences, notifications, organization, password_reset_tokens, permissions, principal_scopes, push_subscriptions, retention_policies, role_permissions, roles, security_settings, service_credentials, subscription, totp_credentials, trusted_origins, webauthn_credentials

Sales (CRM)

activities, clients, contacts, contract_documents, contract_lines, contract_review_comments, contract_review_runs, contract_review_threads, contract_review_topics, contract_types, contracts, deal_contact_roles, deal_contacts, deal_loss_reasons, deal_stage_history, deal_stages, deals, exchange_rates, leads, migration_results, migration_runs, migration_sessions, pipeline_weekly_snapshots, quote_lines, quotes, sales_targets, source_identities, web_to_lead_forms

Projects and tasks

board_columns, content_rubrics, labels, project_doc_labels, project_doc_versions, project_docs, project_financial_data, project_members, project_risk_assessments, project_risk_measures, project_videos, projects, releases, sprints, strategy_documents, task_assignments, tasks, timeline_filter_preferences, work_item_comments, work_item_images, work_item_labels, work_item_links, work_items

Time, leave and team

active_timers, approval_decisions, approval_flows, approval_requests, approval_stages, availability_exceptions, availability_rules, booking_links, bookings, daily_reminder_deliveries, employee_achievements, entries, fish_catches, generated_timesheet_absences, generated_timesheet_calendar_marks, generated_timesheet_lines, generated_timesheets, holidays, kudos, leave_allocations, leaves, locked_periods, meeting_types, office_focus, office_games, office_gnome_finds, office_work_pins, office_workdays, quiz_answers, quiz_questions, reminder_runs, timesheet_submissions

Finance

bank_accounts, bank_import_profiles, bank_transactions, expense_categories, expense_lines, finance_documents, finance_folder_import_items, finance_import_batches, incoming_invoices, invoice_lines, invoice_reminders, invoices, payments, purchase_documents, reconciliation_matches, supplier_engagements, suppliers

Marketing

campaign_links, campaign_recipients, campaigns, email_allowance_charges, email_allowance_windows, email_templates, linkedin_post_stats, linkedin_stats_daily, marketing_suppressions, marketing_templates, newsletter_issue_sends, newsletter_issues, newsletter_subscribers, newsletters, segments, sequence_enrollments, sequence_sends, sequence_steps, sequences, tracked_sites, website_daily_salts, website_dimension_daily, website_events, website_stats_daily

Recruitment

candidate_stage_history, candidates, job_application_forms, job_positions, recruitment_stages, talent_pool_memberships, talent_pools, talent_profiles, talent_types

Service

case_comments, case_emails, case_images, case_mailbox_state, case_queues, cases, support_requests, web_to_case_forms

Community

community_categories, community_comments, community_posts, community_spaces, community_votes

Documents and records

custom_field_definitions, document_extraction_jobs, document_storage_settings, document_versions, documents, folder_templates, pending_blob_deletes, record_facts, record_folders, record_layouts

AI and automation

agent_action_rates, agent_inbox_decisions, agent_inbox_digest_preferences, agent_notes, agent_proposals, agent_runs, agent_task_actions, agent_tasks, agent_trust_suggestion_dismissals, agent_workflow_definitions, agent_workflow_versions, ai_agent_mcp_servers, ai_agent_roles, ai_agent_skills, ai_agents, ai_audit_log, ai_subscription_connections, automation_rules, doc_recipe_changelog, doc_recipe_drafts, doc_recipe_versions, doc_recipes, doc_runs, doc_skill_package_drafts, doc_skill_package_versions, doc_skill_packages, flow_runs, installed_packs, llm_models, mcp_servers, pack_artifact_origins, pack_artifacts, pack_execution_consents, pack_lifecycle_locks, pack_ownerships, pack_publisher_keys, pack_publishers, pm_chat_attachments, pm_chat_conversations, pm_chat_messages, project_workflow_bindings, scheduled_agent_job_runs, scheduled_agent_jobs, skills, slack_chat_threads, slack_shared_answers, uploaded_packs, workflow_artifacts, workflow_budgets, workflow_dispatches, workflow_executions, workflow_reservations, workflow_run_events, workflow_run_links, workflow_runs, workflow_sources, workflow_stage_attempts, workflow_validation_profile_versions, workflow_validation_profiles, workflow_validation_receipts

Operation and logs

audit_log, fleet_instances, public_intake_rate_limits, telemetry_state

5. Jurisdiction of the infrastructure and protective measures

Provider: ONE is provided by Ai11 Consulting GmbH, Graz, Austria.

Infrastructure: The application, database, file, backup and regular operating log systems of ONE are hosted by Hetzner Online GmbH, Germany, in data centres within the European Union. They are subject to the law of the European Union and its Member States. We do not move the application outside the European Union under the contract (clause 4.7).

Outside this infrastructure: We send email through Microsoft 365. Processing and access from outside the EEA, in particular from the USA, are possible. AI services you connect yourself are governed by your contract with that provider, and data may also be transferred outside the EEA in that case.

Technical and organisational measures:

• Separate application instances and databases per customer.
• Encrypted transmission over HTTPS/TLS. Off-site backups are encrypted before they are stored.
• Access to production systems only for the management and named developers, with personal accounts and two-factor authentication or SSH keys.
• Logging of security-relevant events.

Contractual measures: Our sub-processors are bound by contract under Art. 28(4) GDPR. Article 32 of Regulation (EU) 2023/2854 applies to requests from authorities outside the Union.

6. Sub-processors

Hetzner Online GmbH

Address: Industriestr. 25, 91710 Gunzenhausen, Germany
Purpose: hosting of the application, database, file and object storage, backups and operating logs, including the file storage Ai11 runs on Nextcloud
Data: the workspace and operating data stored in these systems
Place of processing: data centres in the European Union
Data protection basis: data processing agreement under Art. 28 GDPR

Microsoft Ireland Operations Limited

Address: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
Purpose: sending system, transactional and notification emails, and email support, through Ai11’s Microsoft 365 Business subscription
Data: names, email addresses, email content, technical communication data and any attachments sent for support
Places of processing: under the Microsoft contract terms applicable to the subscription and the tenant configuration. Processing and access from outside the EEA, in particular from the USA, are possible
Data protection basis: the Microsoft Products and Services Data Protection Addendum applicable to the subscription. Transfers to third countries are covered by the safeguards it provides, in particular the EU standard contractual clauses, where applicable

We use no payment provider and no separate third-party support system. Ai11 engages no AI providers for this offer; AI services you connect yourself are governed by clause 11 of the DPA.

We announce changes to this list at least 30 days in advance by email to the workspace administrator (DPA, clause 5.4).