Data processing agreement
Our standard DPA in line with Article 28 of the GDPR, or a review of yours.
AIPPORTUNITY / TRUST CENTER
Trust,
by design.
When you entrust us with your systems and data, you need to know exactly how we protect them. This trust center explains how we handle security, privacy, AI and continuity, and which documents we can provide for your due diligence.
Request our data processing agreementISO/IEC 27001.GDPR.EU AI ACT.NIS2.
AT A GLANCE
Four pillars
of trust.
Security and privacy are not a separate project for us. They are part of how we design, build and support every solution.
SECURITY
Information security
Practices aligned with ISO/IEC 27001, from access control to incident response.
PRIVACYPrivacy & GDPR
Privacy by design, EU hosting where possible and a data processing agreement whenever we process personal data for you.
AIResponsible AI
Risk-based AI development in line with the EU AI Act, with people in control.
CONTINUITYContinuity & support
Monitoring, backups and support under clear service agreements.
01 / SECURITY
Information
security.
Our information security practices follow the ISO/IEC 27001 framework. Security is part of every phase of our work, from design to operation.
- Risk assessments at the start of every project and for every significant change
- Role-based access with multi-factor authentication and the principle of least privilege
- Encryption of data in transit and at rest
- Secure development: code reviews, automated tests and dependency scanning
- Logging and monitoring of production environments
- A documented incident response process, including timely notification of affected clients
- Support for clients that fall under NIS2, including supply chain security requirements
02 / PRIVACY
Privacy and
data protection.
We process personal data in accordance with the GDPR. When we process personal data on your behalf, you remain the controller and we act as processor under a data processing agreement.
- A data processing agreement (DPA) for every engagement in which we process personal data
- Hosting within the European Economic Area wherever possible
- Standard contractual clauses and additional safeguards for any transfer outside the EEA
- An up-to-date overview of sub-processors, with notice before changes
- Support for data protection impact assessments (DPIAs) and data subject requests
- Data minimisation and retention periods agreed per project
- More details in our privacy statement
03 / RESPONSIBLE AI
AI with
clear boundaries.
The EU AI Act sets rules for AI based on risk. We design every AI solution with those rules, and your own policies, in mind.
- Risk classification of every AI use case before development starts
- Human oversight for decisions with a significant impact on people
- Transparency towards users when they interact with AI
- Documentation of models, data sources and known limitations
- Configurations that prevent your data from being used to train third-party models
- Evaluation of accuracy and bias before and after go-live
- Support with AI literacy for your teams
04 / CONTINUITY
Continuity
and support.
Your solution needs to keep working after go-live. We agree clear service levels and make sure we can recover quickly if something goes wrong.
- Service level agreements with agreed response and resolution times
- Monitoring and alerting on availability and performance
- Regular, tested backups and documented recovery procedures
- Planned maintenance and timely security updates
- Documentation and handover so your own team can maintain the solution
- A named point of contact for every client
DOCUMENTS FOR YOUR DUE DILIGENCE
Everything you need
to decide with confidence.
Procurement and security teams often need documentation before a project can start. We are happy to provide the following on request.
Sub-processor overview
The service providers we use to process data, with their locations.
Security questionnaires
We complete your security questionnaire or vendor assessment.
Service level agreement
Our SLA with service levels, response times and escalation procedures.
RESPONSIBLE DISCLOSURE
Found a
vulnerability?
We appreciate the help of security researchers. If you believe you have found a vulnerability in one of our systems, report it to us confidentially. Give us reasonable time to fix it before disclosing it publicly, and do not access or change data beyond what is needed to demonstrate the issue. We will respond promptly and keep you informed.
A FEW THINGS PEOPLE ASK
Fair questions.
Are you ISO/IEC 27001 certified?
Our information security practices follow the ISO/IEC 27001 framework. Ask us about our current status and we will gladly explain how our controls map to the standard.
Where is our data stored?
Within the European Economic Area wherever possible. We agree on hosting locations per project and record them in the data processing agreement.
How do you handle security incidents?
We follow a documented incident response process: detect, contain, investigate and recover. If an incident affects your data, we inform you without undue delay so you can meet your own obligations.
Do you support organisations that fall under NIS2?
Yes. We help clients meet NIS2 requirements for their digital supply chain, for example through security agreements, incident reporting arrangements and documentation.
QUESTIONS ABOUT SECURITY OR PRIVACY?
We’re happy
to explain.
Whether you’re preparing a tender, completing a vendor assessment or simply want to know more, we’ll answer your questions openly.
Start a conversation