Privacy Operations Cockpit
Espresso Data Privacy puts data protection into practice where the data lives: it finds personal data in your systems, answers requests from data subjects, controls AI data, deletes according to your rules and proves every step. Operated in your data centre, in your cloud or by an operating partner.
Registers, policies and data deletion concepts record what ought to be done. It is then carried out by hand, year after year – or not at all. Sooner or later, internal audit, the regulator or a data subject will ask: Where is the data, who uses it, and can you prove what has happened to it?
It sits in core systems, peripheral systems, archives, file storage and Microsoft 365 – linked by dependencies that no one fully grasps.
Every access request means searching many systems, compiling the results and meeting the deadline.
The data deletion concept is in place, but deleting across many systems is laborious and keeps getting postponed.
Prompts, transcripts and Copilot output store personal data all over again – in places no register knows about.
What has happened is shown by one-off checks and lists, not by an auditable log.
How Espresso finds personal data, answers requests, deletes according to your rules and proves every step – an overview with fictitious sample data.
Deletion obligations, data subject access requests or the start with Copilot: every organisation has its own urgent issue. Two routes are particularly well suited – but you can just as well start wherever things are most pressing for you and build from there.
Fulfil deletion obligations across many systems and prove it to internal audit and the regulator. Your systems do the deleting themselves; Espresso orchestrates, takes dependencies and objections into account, obtains approvals and logs every step.
Data Deletion
Go to deletionWhere is our personal data? What is overdue? Is Microsoft 365 ready for Copilot? Espresso scans your sources and shows the result in the cockpit – the fastest way there is a fixed-price assessment.
Data Discovery · Privacy Register · AI Privacy Control
Go to the assessmentSix modules that work together – and can be licensed individually. Start with one and expand when you are ready.
find
Finds personal data in file storage, databases and Microsoft 365 – using rules and local detection of names and addresses, without any data going to third parties.
record
Maintains the register of your systems and processing activities based on actual findings rather than questionnaires alone – including the record of processing activities.
handle requests
Handles access and erasure requests from data subjects: search across your systems, deadlines in view, deletion with proof.
delete and prove
Orchestrates deletions across many systems, with dependencies, objections, approvals and a deletion log for every run.
control AI data
Records AI systems, classifies them and checks stored AI data such as prompts, transcripts and content generated by Copilot.
share safely
Pseudonymises data before it is passed to an AI or to third parties and puts the original values back into the response – plus protected exports and test data, with proof of who received what.
Documentation tools record the concept. Espresso puts it into practice in your systems and delivers the proof.
Core systems, databases, file storage and Microsoft 365: Espresso finds, queries and deletes via open interfaces – without touching the business logic, across SAP and non-SAP landscapes alike.
In your data centre, in your cloud or with an operating partner. Your personal data stays under your control.
Findings flow into the register, erasure requests into deletion once approved, proof back to the request. One complete picture of all obligations instead of many spreadsheets.
Espresso already searches your data locally today, without the cloud – including names and addresses in free text. Every future AI function will likewise run in your environment – without any data going to external AI services.
Approvals by authorised people (four-eyes principle for retention periods and erasure requests) and an audit trail in every module: traceable for internal audit and the regulator – and controlled by people, not by an AI that guesses.
Reference
Pax, the Swiss pension insurer based in Basel, uses Espresso Data Privacy to delete personal data automatically across SAP and non-SAP systems – in production since 2024.
Read the case study“Pax stands for simple, digital processes with personal service for customers and sales partners. Thanks to the Espresso Data Privacy solution, we were able to streamline these processes significantly and achieve full compliance with data protection laws effortlessly. The system ensures smooth, uninterrupted operation across our entire company – with minimal effort.”
Espresso is built for organisations that work with large volumes of personal data, legacy IT landscapes and demanding compliance requirements.
No telemetry, no licence server, no access without your approval.
Sign-in via your identity provider, roles per module, approvals by authorised people, audit trail, technical logs without personal data.
Several companies, brands or customers in one installation – cleanly separated from one another.
Supports the requirements of the Swiss Federal Act on Data Protection and the GDPR – as well as other rules such as statutory retention periods, professional and official secrecy or internal policies.
See within six weeks where your personal data is stored and where action is needed – with a focus on Copilot and AI if you wish. At a fixed price, with a report.
Espresso on your test systems, with jointly agreed success criteria.
Installation, connection of your systems, training – all the way to production.
From the data deletion concept and retention schedule to connecting your applications for deletion and access requests.
Espresso Data Privacy is a Privacy Operations Cockpit from Yoosana GmbH in Zug. Six modules find personal data in your systems, maintain the register, handle requests from data subjects, delete according to defined rules, control stored AI data and share data safely – with proof for every step. Espresso runs at the customer's site: in your own data centre, in your own cloud or with an operating partner.
A data protection management system documents obligations: registers, deadlines, policies. A Privacy Operations Cockpit puts them into practice in the systems – it finds, processes, deletes and delivers the proof.
No. Each module can be licensed individually; AI Privacy Control and Privacy Delivery build on Data Discovery. Start with what matters most and add further modules when you are ready.
Data Discovery scans file storage, the databases PostgreSQL, MySQL, MariaDB and Microsoft SQL Server, Microsoft 365 and stored data from the use of Claude. For deletions, your applications are connected via an open interface, using REST or Azure Service Bus – including core systems and SAP environments. For access requests, Subject Request searches supported databases and REST interfaces or queries the system owners.
Subject Request records the request, searches the connected systems for the data subject's data, keeps track of the deadline and prepares the response. After four-eyes approval, an erasure request is passed on for deletion, and the result is returned to the case.
Data Discovery shows where personal data is stored in Microsoft 365 before Copilot finds it. AI Privacy Control controls stored AI data such as prompts, chat histories, stored transcripts and content generated by Copilot.
Yes. Privacy Delivery generates test data in a valid format, pseudonymises data for analytics and AI applications, and records who received which data.
Espresso runs wherever you operate it: in your data centre, in your own cloud or with an operating partner. Espresso never establishes a connection to the vendor of its own accord.
Espresso complements Purview. Purview is geared towards Microsoft 365; Espresso works across all systems – from the core system to the archive – and integrates Microsoft 365.
Espresso implements data subject rights and deletion obligations technically and delivers the proof – for personal data under the Swiss FADP as well as under the GDPR. Since the revised FADP came into force, responsible individuals face fines of up to CHF 250,000 (Art. 60 et seq. FADP). Which obligations apply to your organisation is something to assess with your legal advisers.
With a 30-minute demo or directly with a fixed-price assessment – with a focus on Copilot and AI if you wish.
We will show you the cockpit with sample data – and discuss where you should start.
Request a demoor write directly to info@espressodataprivacy.com
