Data Act information

The EU Data Act (Regulation (EU) 2023/2854) gives every customer of a cloud service the right to switch to another provider, or to their own infrastructure, and to take their data with them. This page gives the information the Data Act requires us to publish. It forms part of our Terms of Service (section 9), and applies on every plan, including Free and the free trial.

Where our infrastructure is, and which law it is subject to

• Venom Labs, S.L. is a company established in Spain and subject to Spanish and EU law. Its registered office is at Urbanización Reserva de Marbella, Fase 2, Manzana 3, Bloque 7, Piso 7309, 29604 Marbella (Málaga), Spain.
• The web app, the MCP server, and the services and databases behind them run on Amazon Web Services in the EU region in Ireland (eu-west-1). That infrastructure is located in Ireland and subject to Irish and EU law. Our AWS organization policy blocks the use of other AWS regions for these services.
• The provider of that infrastructure, Amazon Web Services, belongs to a group whose parent company, Amazon.com, Inc., is established in the United States. Laws of the United States may therefore apply to it, including laws that allow US authorities to request data held by US companies abroad.
• Our marketing website and documentation hold no customer data. They are delivered through Amazon CloudFront’s global network.
• Our other service providers, and what they receive, are listed in our Data Processing Agreement. Apart from our support mailbox (Google Workspace) and error reports from the web app (PostHog, EU cloud in Germany), none of them receives your workspace content.

How we protect your data against unlawful access by foreign governments

We take the following measures to prevent access to, or transfer of, non-personal data held in the EU by authorities outside the EU, where that would conflict with EU law or Spanish law.

Technical measures

• All customer data is stored and processed in the EU (Ireland). Our AWS organization policy blocks the other AWS regions for our services.
• Data is encrypted in transit (HTTPS with TLS 1.2 or 1.3) and at rest (AES-256 for files, and AWS encryption for databases). Credentials for third-party services are encrypted with a dedicated key in AWS Key Management Service.
• Access to customer data is limited to the services that need it, and every request is checked against the user’s live membership in the organization. Administrative activity in our AWS accounts is recorded in AWS CloudTrail, in a separate security account.

Organizational measures

• We treat every request from a public authority for customer data as needing a legal check. We disclose non-personal data to an authority outside the EU only if the request is based on an international agreement in force with the EU or Spain, such as a mutual legal assistance treaty, or if the conditions in Article 32(3) of the Data Act are met. Otherwise we refuse it.
• We challenge requests that are unlawful or too broad, and where we must answer, we give only the minimum data the request requires.
• Before we comply with a request about your data, we tell you, unless the request is for law enforcement purposes and telling you would undermine it, for as long as that is the case.
• Where we are unsure whether a request meets these conditions, we ask the competent Spanish authority for its opinion before answering.

Contractual measures

Our Terms of Service (section 11.4) and Data Processing Agreement (section 5) commit us to the steps above.

These measures reduce, but cannot remove, the risk that a provider subject to non-EU law is ordered to give access to data. We will update this page if anything changes.

What you can take with you

Your “exportable data” (Terms, section 9.2) is the data that you, your members and your AI agents put into Venom, and the data generated by your use of it, apart from what each member keeps in their personal scope (below). It includes:

• projects: names, descriptions and overviews;
• tasks: briefs and statuses;
• log entries, including deleted entries that are still recoverable, with their authors, agent names and times;
• mentions;
• artifacts, with all their revisions;
• skills, with all their files;
• teams, and your members’ names, handles and roles;
• your organization’s settings, and the list of third-party MCP servers you added; and
• records of your agents’ activity from the last 30 days.

It doesn’t include what each member keeps in their personal scope, such as their personal skills, personal MCP servers and personal guidance, because only that member can see it in Venom. Each member can read their own personal skills and MCP servers through the MCP server or the web app and take them with them.

We don’t export the following, because they are specific to how our service works internally and would reveal our trade secrets or compromise security (Data Act, Articles 25(2)(f) and 30(6)): our security, server and firewall logs; our internal product analytics; and the secret values we store (third-party credentials and MCP tokens). You can enter credentials again with your new provider. These exclusions don’t affect anyone’s rights over personal data under the GDPR.

Formats and interfaces

• The Venom MCP server (mcp.venomlabs.dev) uses the open Model Context Protocol. Every read operation returns structured JSON described by a published JSON Schema, which any MCP client can list. Text fields contain Markdown as written; skills and artifacts are returned as their original text files.
• In the web app, owners and admins can download a ZIP of the organization’s exportable data from Settings → General, in the same format as the complete copy below. Each file is described at docs.venomlabs.dev/reference/data-structures. You can also download any artifact revision as its original file.
• On request to support@venomlabs.dev, we provide a complete copy of your organization’s exportable data within 30 days: JSON for projects, tasks, log entries, mentions, teams, members, settings, the list of third-party MCP servers and agent activity records, and the original files for artifacts (with all revisions) and skills.
• These interfaces are free of charge for you and for the provider you are moving to.

How to switch

1. Send a switching notice. An owner of your organization emails support@venomlabs.dev with “Switching notice” in the subject, saying:

• whether you want to move to another provider (name it if you’d like us to work with them), move to your own infrastructure, or only have your data erased;
• the date you want the switch to start, which can be up to two months away (if you don’t give one, it starts when we confirm your notice); and
• whether the notice covers your whole organization.

2. We confirm within 3 working days.

3. Transitional period, up to 30 days. From the start date your plan stays as it is and the Service keeps running. You export your data. We help you and anyone you authorize, give you all the information relevant to your exit, tell you about any known risks to continuity, and keep your data secure throughout. You can extend this period once, for as long as you need, by telling us before it ends. If 30 days is technically unfeasible, we tell you within 14 working days of your notice, with our reasons and an alternative period of no more than 7 months, and the Service continues during it.

4. You tell us the switch is complete. Your contract then ends, and we confirm it in writing. If you asked only for erasure, it ends at the end of the notice period.

5. Data retrieval period, at least 30 days. After the transitional period, your data stays available for you to retrieve.

6. Erasure. When the retrieval period ends, we erase your exportable data and confirm it in writing. We keep only what the law requires us to keep, such as billing records for 6 years, and our confirmation says what we keep and why. Copies in our backups expire within 100 days.

Charges

We don’t charge for switching, for exporting your data or for data egress, and we charge no early termination fees. If you leave a yearly plan early to switch provider or to have your data erased, we refund the fees paid for the remaining whole months (Terms, section 8.10). Our standard prices are on our pricing page.

Known limitations and risks to continuity

• The organization’s export leaves out each member’s personal skills, personal MCP servers and anything else in their personal scope, because only their author can see them in Venom. Each member can read their own personal skills and MCP servers through the MCP server or the web app and take them with them.
• Reads through the MCP server return what the connected user is allowed to see, a page at a time (up to 100 items per page). An owner or admin sees the most. A single artifact can be read in full up to 256 KiB.
• Through the MCP server, each person can read only their own mentions, and disabled or withdrawn skills can’t be read. They are included in the organization’s export, both the ZIP in Settings and the complete copy from support, except members’ personal skills, which are in neither.
• Deleted log entries can be recovered and exported for 30 days after deletion. After that they are gone.
• Records of agent activity are kept for 30 days, so only the last 30 days can be exported. They can’t be read through the MCP server; they are included in the organization’s export, both the ZIP in Settings and the complete copy from support.
• Data is exported in Venom’s own structures. No common standard for this type of service has been published yet. When the European Commission publishes one, we will support it as the Data Act requires.
• Switching does not interrupt the Service, but any AI clients or plugins you have connected keep pointing at Venom until you reconfigure them.

Which Data Act obligations don’t apply to us

None. Our plans are not custom-built for individual customers, and we don’t offer a separate non-production test version, so every obligation in Chapter VI of the Data Act applies to every plan. If an Enterprise contract includes features built for one customer, that contract will say which obligations don’t apply to them.

Questions

Email support@venomlabs.dev. Venom Labs, S.L., NIF B05853908, Urbanización Reserva de Marbella, Fase 2, Manzana 3, Bloque 7, Piso 7309, 29604 Marbella (Málaga), Spain.