Technology and trust
Letting us into your company is a serious decision
That's why we tell you up front what we do with your data, what the machine decides, what a person decides and what we will never do.
Technology
How the HUB is built
The HUB is Xarxalia's own platform: software we developed ourselves, running on servers we administer in Barcelona. It brings agents, data, conversations, automations, permissions, human oversight and traceability together in a single architecture.
The HUB, our own software
We wrote it in-house at Xarxalia. When a project needs something the HUB doesn't do yet, we build it.
Integration via API, MCP and A2A
The HUB has its own API and connectors for ERP, CRM and Microsoft Teams. It supports MCP (Model Context Protocol) and A2A (Agent2Agent), the open protocols agents use to connect to tools, to data and to other agents.
Corporate SSO
Your team can sign in to the HUB with their corporate account through single sign-on (SSO), so access is tied to the directory you already use to manage company accounts.
Roles and permissions
Access to the HUB is controlled by role. Each agent has permissions set action by action and works at one of four autonomy levels, configurable per channel and per type of action, which the organisation can lower at any time.
Auditable log
Actions by people and by agents go into a single log, with a date and an owner, and no entry can be altered afterwards. You can use it for any audit.
Client separation
Each organisation works in its own space inside the HUB, isolated from other clients' spaces.
Data architecture
Data comes in through the channels the system handles (WhatsApp, email, web and phone) and through integrations with the organisation's tools, such as the ERP, the CRM or billing. It is processed in the HUB, on servers Xarxalia administers in Barcelona, and doesn't leave the European Economic Area. If a project uses other providers, such as a third-party AI model, they are listed in the sub-processor register before signing. Each company has its own separate space and every action is recorded with a date and an owner. Data is kept for the period set by the retention policy, and the organisation can take its data with it at any time, in open formats.
Commitments
What we guarantee
The data is yours
The data the HUB processes lives on servers Xarxalia administers in Barcelona, and we only process it to provide the service. You can take it with you whenever you like, in open formats, and we don't hold anything back.
You always know who's speaking
When a digital employee answers, it says so. We don't pass a machine off as a person on any channel.
A person always in charge
You set the autonomy level of each digital employee and you can lower it at any moment, without telling us first.
Data protection and AI regulation
We work with a data processing agreement, a record of processing activities and a retention policy, and we meet the transparency obligations of the EU AI Act.
Data sovereignty
Our own technology, servers in Barcelona
The HUB is our own software (we don't resell anyone else's platform) and it runs on infrastructure we administer, inside the European Union and under European jurisdiction.
Our own infrastructure
We administer the HUB's servers in Barcelona and don't depend on any third-party cloud for the core of the platform.
European jurisdiction
Data processed by the HUB doesn't leave the European Economic Area. If a project needs another provider, it is listed in the sub-processor register before signing.
GDPR and the AI Act
Data processing agreement, record of processing activities, retention policy and the transparency obligations under the EU AI Act.
Our own product
We wrote the HUB and MIA, so we can change whatever your case needs without waiting for a vendor's roadmap.
Our commitment
If a decision would let us grow faster but put a client's trust at risk, we'll choose trust.
We measure our success by revenue, but also by how your business grows when your team, freed from repetitive work, serves more customers, better.
The limits
What we won't do
We won't sell or hand your data to anyone.
We won't train anyone else's models on your business information.
We won't switch on any automation you haven't approved first.
We won't tell you a feature is ready when it isn't.
We won't replace anyone on your team unless you decide to.
We won't lock you in: if you want to leave, we make it easy.
Documentation
Everything in writing, before you sign
Ask us for any of these documents and we'll send it over, no strings attached.
Data processing agreement
Purposes, duration, security measures, sub-processors, transfers and deletion.
Security policy
Encryption, access control, two-factor authentication, backups and monitoring.
Responsible AI policy
Autonomy levels, human oversight, traceability and the limits of the system.
Data retention policy
How long each thing is kept and what happens when the relationship ends.
Service level agreement
Availability, response times, incident grading and escalations.
Sub-processor register
Which providers are involved, what for and where the data sits.
What problem should artificial intelligence solve in your company?
Before we talk about technology, we want to understand the problem. Tell us which process you want to transform, which systems are involved and what result you need.
Frequently asked questions
Where is my company's data stored?
Data processed by the HUB lives on servers Xarxalia administers in Barcelona and doesn't leave the European Economic Area. The HUB runs on our own infrastructure and the core of the platform doesn't depend on a third-party cloud. If a project uses another provider, such as a third-party AI model or the organisation's own cloud, it is listed in the sub-processor register before signing. We only process the data to provide the service.
Who can see my company's data?
No other Xarxalia client has access: each company has its own space and nobody can see another's information, whether by mistake or through a setting. We don't sell or hand your data to anyone, and we don't train anyone else's models on your business information. Encryption and access control are set out in the security policy, which you can ask for before signing.
Can MIA access all of my company's information?
No. MIA only accesses the sources, data and functions the organisation has authorised for each use case. Access is set up by role and permission, so each user and each agent can only view or do what they're entitled to. The system's queries, access and actions are logged and can be audited. The AI doesn't get access to your company: it gets only the permissions it strictly needs to do the job you've given it.
If I leave one day, what happens to my data?
You can leave whenever you want, and we make it easy: Xarxalia hands your data over in open formats and holds nothing back. The data retention policy, which we send you before you sign, sets out how long each thing is kept and what happens when the relationship ends.
How do you comply with the EU AI Act?
Xarxalia meets the transparency obligations of the EU AI Act and there is always human oversight. When a MIA digital employee answers, it says so: we don't pass a machine off as a person on any channel, and that's been a legal obligation since August 2026. You choose one of four autonomy levels and can lower it without telling us first. The responsible AI policy sets out the limits.
Which external providers are involved in the service?
Xarxalia gives you the list in writing: the sub-processor register states which providers are involved, what for and where the data sits. The core of the platform doesn't depend on them, because the HUB is our own software and we don't resell anyone else's platform. Sub-processors, transfers and deletion are also set out in the data processing agreement.
Can I audit what the system has done on my account?
Yes. The HUB records every action, decision and change with a date and an owner, and you can inspect and audit it. If you want to review this before signing, Xarxalia sends you the security policy, with access control and monitoring, and the responsible AI policy, with traceability and the limits of the system.