# Trust and legal (/docs/en/trust)



These pages state what Salisan does, as far as it can be checked in the product, in the infrastructure configuration and in the published legal documents. Where a document or decision is not published, the page says so and says how to ask.

<Callout type="info">
  The data processing agreement and the subprocessor register are on salisan.com but marked pending review. Read [Legal documents](/docs/en/trust/legal-documents) for what is published.
</Callout>

<Cards>
  <Card title="Security" href="/en/trust/security" description="Sign-in protection, two-factor, single sign-on, sessions and encryption." />

  <Card title="Access and audit" href="/en/trust/access-and-audit" description="Roles, patient access, Salisan staff access and the audit log." />

  <Card title="GDPR and data protection roles" href="/en/trust/gdpr" description="Controller and processor roles, the DPA and subprocessors." />

  <Card title="Data location" href="/en/trust/data-location" description="Where data is stored, what can leave the EU region and how long copies are kept." />

  <Card title="Patient rights" href="/en/trust/patient-rights" description="Export, correction, restriction and erasure tools." />

  <Card title="How the AI works" href="/en/trust/how-the-ai-works" description="What the AI features do, which providers receive data and how to limit them." />

  <Card title="Clinical responsibility" href="/en/trust/clinical-responsibility" description="What the Agent proposes, what you confirm and what Salisan does not claim." />

  <Card title="Legal documents" href="/en/trust/legal-documents" description="Terms, privacy policy, cookie notice and the documents not published yet." />
</Cards>

For privacy questions and documents, write to [privacy@salisan.com](mailto:privacy@salisan.com). For the Terms and legal notices, write to [legal@salisan.com](mailto:legal@salisan.com).