Institutional governance framework, GDPR compliance architecture, and sovereign infrastructure commitments across the European Union.
AZComply is engineered on the foundational principle of Privacy by Design (Art. 25 GDPR). Our platform operates strictly as a regulatory analysis workspace and technical audit generator, never as a permanent data warehouse. We process the technical minimum required to deterministically assess your AI systems and enforce immediate destruction of ephemeral extraction context.
For Workspace and Enterprise accounts, you act as Data Controller and AZComply operates as Data Processor under Articles 4(7) and 4(8) of Regulation (EU) 2016/679 (GDPR). We process technical specifications and compliance dossiers solely pursuant to your documented instructions, governed by our Data Processing Agreement (DPA) incorporating Article 28 GDPR terms. For public website visitors and free preview assessments, AZComply acts as Data Controller.
Enforceable institutional guarantees safeguarding your intellectual property and engineering assets:
Raw technical documentation: inspected strictly in volatile random-access memory (RAM) during extraction, never committed to unencrypted persistent disks.
Absolute non-training guarantee: customer inputs, uploaded dossiers, prompts, and architecture files are NEVER used to train, retrain, fine-tune, or align any foundation, commercial, or public AI models.
Raw file text: permanently purged immediately following the extraction of structured regulatory facts (Art. 5(1)(c) GDPR data minimisation).
Incidental personal data: our extraction pipeline systematically discards personal identity data found in engineering files, retaining only verifiable regulatory specifications.
Transparent schedule of technical data categories required to deliver the compliance service:
| Data Category | Infrastructure & Region | Retention Window | GDPR Legal Basis |
|---|---|---|---|
| Generated conformity dossiers & signed audit PDFs | Encrypted Supabase Storage (eu-central-1, Frankfurt, Germany) | 30 days (or workspace lifetime upon user instruction) | Contract performance (Art. 6(1)(b)) |
| Classification metadata (system identifier, risk level, active duties) | Isolated PostgreSQL instance (eu-central-1, Frankfurt, Germany) | Account lifetime | Contract performance (Art. 6(1)(b)) |
| Statutory audit trails (EU AI Act Article 12 compliance records) | Immutable encrypted storage (eu-central-1, Frankfurt, Germany) | Statutory retention period under EU AI Act | Legal obligation (Art. 6(1)(c) GDPR & Art. 12 AI Act) |
| Security access logs & administrative event monitoring (TOMs) | Hardened EU infrastructure (eu-central-1, Frankfurt, Germany) | 12 rolling months | Legitimate interest / Security (Art. 6(1)(f)) |
| Account authentication profiles (business email, enterprise name) | Encrypted Supabase Auth (eu-central-1, Frankfurt, Germany) | Account lifetime | Contract performance (Art. 6(1)(b)) |
| Billing, subscription transactions & tax records | Lemon Squeezy (Merchant of Record with EU DPA and SCCs) | Statutory fiscal window (7 to 10 years) | Legal tax obligation (Art. 6(1)(c)) |
All customer data storage, database hosting, and language model inference clusters reside 100% inside EU Member States:
Enterprise Data Vault & Database Infrastructure
eu-central-1 Region (Frankfurt, Germany)
Dedicated PostgreSQL database cluster, user authentication, and encrypted compliance documentation repository.
Sovereign EU AI Inference Cluster
europe-west4 Region (Eemshaven, Netherlands)
Dedicated European inference cluster for technical document extraction and narrative dossier compilation.
Commercial Payment & Merchant of Record Gateway
Lemon Squeezy (Merchant of Record with EU DPA)
Card processing, SEPA bank transfers, and automated cross-border EU reverse-charge VAT validation.
AZComply implements institutional security protocols aligned with Article 32 GDPR and Article 9 risk management specifications of the EU AI Act:
All network transit enforced via TLS 1.3 with Perfect Forward Secrecy; all persistent database volumes encrypted with AES-256-GCM.
Statutory risk tiering is executed by deterministic local Python rule trees, guaranteeing zero hallucination in legal determinations.
Role-based access management (RBAC), multi-factor authentication (MFA), and rotating cryptographic API tokens.
Continuous vulnerability scanning, container isolation, and disaster recovery environments strictly hosted in the EU.
As an authorized enterprise user or natural person, you hold the following statutory rights:
Obtain formal confirmation of whether personal data is processed and inspect a structured inventory of records.
Request immediate correction of inaccurate or outdated organizational profile and contact data.
Request permanent cryptographic deletion of your workspace, generated dossiers, and associated audit logs.
Export your complete assessment history, technical dossiers, and audit ledgers in standard machine-readable formats (JSON/PDF).
Object to processing grounded in legitimate interest, subject to mandatory statutory retention requirements.
For systems classified as High-Risk under Annex III of Regulation (EU) 2024/1689, AZComply automatically generates an immutable audit record establishing technical traceability. This audit trail records the deterministic statutory decision chain and relevant EUR-Lex article citations without storing personal data from submitted documents.
Conformément à l’article 77 du RGPD, toute personne concernée ou entité dispose du droit d’introduire une réclamation auprès de l’autorité de contrôle compétente pour sa juridiction :
Ce droit de recours s’exerce sans préjudice de tout autre recours administratif ou juridictionnel auprès des juridictions compétentes (den zuständigen Gerichten in Brüssel, Belgien, oder dem Gerichtsstand des EU-Nutzers).
An institutional Data Processing Agreement incorporating the European Commission’s Standard Contractual Clauses and Article 28 GDPR terms is available for all enterprise accounts. It sets forth our binding commitments regarding security, sub-processor notification, and 48-hour incident reporting.
