How your data is handled.

Local Python can sort, calculate, reconcile, filter, aggregate, and create outputs. A workflow may use it before a model step when that improves the work.

The plugins do not automatically anonymise or pseudonymise data. Names, documents, original language, and case facts remain when they are useful for the professional purpose.

Each workflow can use data differently. Its own page explains the operational sequence: what the model sees, what code processes, and when the process stops. This page does not duplicate those workflow-specific statements.

Never put passwords, API keys, authentication cookies, access tokens, or session material in prompts or files the selected AI workspace can read.

After every substantive Vera run, a compact report records each model-visible phase in the workflow's natural units. It distinguishes the source extent available, what code processed locally, what was visible to the model, which part was never visible to the model, why the context was needed, and the available evidence basis. When the host can write files, Vera keeps a JSON receipt and a Markdown version in that run's output; otherwise it shows the report in chat and says that no durable receipt was created. The locally processed total and the never-model-visible part overlap; they are not alternative categories to add together.

A possible narrower code path appears only when evidence from the run supports it and identifies a safeguard for analytical quality. A complete relevant document or population can be the correct minimum. The report is not network monitoring, a provider attestation, a DPIA, a legal opinion, or GDPR certification; a recorded hash binds a receipt to bytes but does not prove provider-side delivery.

Each durable run automatically sends Mparanza only a random receipt ID, the Vera version, and the digest of the local report. Mparanza adds its server time and Ed25519 signature and retains those proof fields without the report, client data, filenames, source content, or source-document hashes. The resulting HTML can be sent to a customer, printed as PDF, and checked on the public verification page. This proves existence, server time, and report integrity only; it does not independently prove who submitted the digest. If the receipt service is unavailable, the work and local report remain complete and the request stays pending for retry.

A connected app, public search, portal, or send action is used only when that route is part of the selected work. The destination's terms and controls apply separately.

Using an external destination does not make Mparanza the recipient. The workflow or point-of-use notice identifies a Mparanza-hosted route when one is involved.

When a function uses a Mparanza-hosted service, the content needed for that service reaches Mparanza-controlled systems. Hosted interviews, voice capture, and retail data are examples.

The notice shown where that service is used states what reaches it and the applicable access, retention, and deletion arrangement.