Last updated: 12 October 2026 · Evidence Check AI for monday.com
Evidence Check AI is provided by RVDH Interim Management B.V., a company registered in the Netherlands, which publishes its apps under the names Balloon Apps and GetCompliant. RVDH Interim Management B.V. is the party you deal with for this app and the party responsible for the data described on this page.
We store our verdict, not your evidence. The file stays in your monday account. We keep what we concluded about it plus a SHA-256 hash of the bytes, so it can be shown that the verdict was about exactly that file, and never the bytes themselves.
| Stored | Contents |
|---|---|
| Installation | Your monday account id, the moment of installation, the retention period in force, and the monday access token — encrypted. |
| Verdict log | Board, item and column id; the asset id of the attachment; a SHA-256 hash of the evaluated bytes; a SHA-256 hash of the requirement text; a short excerpt of that requirement so the log stays readable; the verdict, confidence and the model rationale (which can quote text from the evidence or the requirement); the model id and prompt version; token counts, latency and the moment of assessment. |
| Overrides | Who overruled a verdict, the previous and the new verdict, the mandatory reason, and when it happened. |
To reach a verdict, the attachment and the requirement text are sent to Anthropic (the Claude API, api.anthropic.com), which acts as our processor for that request and does not train on it; the uploaded file is deleted from Anthropic right after the assessment. We fetch the attachment from monday itself (api.monday.com and monday file storage). The board view loads the official monday SDK from cdn.jsdelivr.net. The app and its database run on a server we rent from Contabo (Contabo GmbH, Germany; data centre in the EU), our hosting provider and processor, which also keeps the daily server backups described below. There are no other third parties: no analytics, no monitoring service, no advertising.
Everything else — the verdict log, the overrides, the installation record — stays in our own PostgreSQL database in the EU.
A verdict does not stay forever. The default retention period is 24 months, counted from the most recent assessment of the same file and requirement. If Assess now re-confirms an earlier verdict, that earlier verdict and its override history are kept for as long as the re-confirmation, and then all of them are deleted automatically. We can set it to any value between 3 and 84 months, either on request or through the app's API. There is no settings screen for it yet, so today it is a deliberate step and not something that changes by accident. The same period applies to the usage record we keep for billing, which holds the board, item and column the call was made for — it is deleted on the same clock, not kept longer.
When you uninstall Evidence Check AI, everything we hold for your account is deleted at that moment: every verdict, every override, the usage record, the installation record itself, and the stored analysis of any requirement text that no remaining verdict refers to. Not a status flag, a real delete, in one transaction.
The monday access token that lets us fetch an attachment is stored encrypted with AES-256-GCM, and it is destroyed by that same delete. After an uninstall there is no credential to your monday account left on our side.
Our nightly database backups are encrypted and kept on our own server for at most 8 days. In addition, our hosting provider Contabo makes a daily backup of the whole server, kept for up to 10 days on separate Contabo storage. That backup is a copy of the entire server, including the server configuration that holds the key used to encrypt the monday access tokens; the database in it stays LUKS2-encrypted, and the passphrase for that is not stored on the server. Contabo backups made before we removed an earlier, unencrypted copy of the database from the server on 16 October 2026 (a copy from before our move to LUKS2 on 14 October 2026) also contain that copy; each of them is gone 10 days after it was made. After you uninstall, your data is therefore gone from every backup within 10 days.
Access, correction, export and erasure: mail info@getcompliant.online. An export of your own verdict log is available at any moment from the board view, as a CSV file — you do not need us for that one.