We help you handle compliance. Here is how we handle our own.

The platform runs in Google Cloud regions inside the EU, and its interface is served from edge servers within the European Economic Area (EEA). No request leaves the EEA — that covers compute, storage, AI analysis and disaster recovery. Because nothing is transferred to a third country, running Audomate needs no standard contractual clauses and carries no Schrems II exposure.

Customer documents are encrypted in transit (TLS 1.3, with TLS 1.2 as the minimum version) and at rest (AES-256, customer-managed keys in Cloud KMS, rotated every 90 days). Two independent layers separate one organisation's data from another's: role-based permissions in the application (RBAC) and row-level access control in the database. That design makes access to another organisation's data impossible.

• A single deletion process covers the vector index, the relational database and object storage.
• Backups allow point-in-time recovery. We keep them in two regions, both inside the EEA.
• Every user action, AI assessment and human override of an assessment goes into an append-only log. A cryptographic hash chain makes any change to its history detectable.

Audomate uses retrieval-augmented generation (RAG) inside a verification framework: every generated finding and document is grounded in the actual regulation and your actual evidence, carries source references and a confidence indicator, and anything the model cannot ground is marked for review rather than stated as fact. The person responsible for compliance reviews, edits or overrides every assessment. We record who decided, when and why. The AI proposes; your team decides.

• The LLMs run in enterprise services inside the EEA, under a contractual zero-retention rule. The model provider does not store prompts or responses. They are never used to train models — not by us and not by the provider.
• Each organisation's audit session is fully isolated. Its context stays in working memory only until the session ends.
• Before any content reaches the model, an input gateway detects prompt injection attempts and sanitises the input.
• Every organisation has a token usage limit and receives alerts on consumption. That keeps the scale of processing under control.
• Organisations that need full independence from external model providers can deploy their own way: an on-premise LLM stack, a portable hardware box or a white-label instance, alongside the standard EU SaaS.

• Network — a WAF in front of the API protects against the OWASP Top 10 and limits DDoS attacks. Internal services communicate over mTLS, and the data layer runs on a private network with no public IP addresses.
• Sign-in — SSO via SAML 2.0 or OIDC with your organisation's identity provider, such as Microsoft Entra ID. Multi-factor authentication (MFA) is mandatory. Access tokens are valid for 15 minutes and refresh tokens are rotated.
• Permissions — role-based access in the application is additionally enforced at the database row level. Credentials are held in a managed secret store, with access logging and 90-day rotation.
• The team — the experts building the platform advise the European Commission on digital identity wallets, sit on the CEN and PKN standardisation committees and advise the Polish Bank Association on AML, eIDAS and PSD.
• Software development — systematic code review, dependency scanning and testing before every release of a new version of the application

Below are the providers that support the Audomate platform. All of them process data in EEA regions only. We give 30 days' notice before adding or changing a sub-processor. The period for objecting is set out in the data processing agreement. The full sub-processor list is pending publication.

• For customer documents, your organisation is the controller and DeepTech sp. z o.o. is the processor. We sign a data processing agreement for every deployment, with annexes describing the technical and organisational measures and the sub-processors.
• Personal data is not transferred outside the EEA. Running the platform therefore requires no standard contractual clauses (SCCs) and no reliance on adequacy decisions.
• We inform affected customers of personal data breaches without undue delay, within 24 hours at the latest. Notification to the supervisory authority follows within 72 hours where Art. 33 GDPR requires it.
• The platform supports data subject rights: access, rectification, erasure and restriction of processing. That includes permanent deletion across every storage layer.
• We maintain an internal record of processing activities (RoPA). We make it available for review once an NDA is signed.

If your organisation is subject to DORA, you will list us in your register of information as an ICT third-party service provider. We have prepared the data and documents needed to assess us. The full pack is available on request — it contains the information below in a form ready to use in the register.

• Incident notification — we inform your named contacts of critical incidents affecting your organisation within 30 minutes on the Enterprise plan, or 24 hours on the Standard and Pro plans. A written report follows within 24 hours.
• Audit and access rights — the contract gives you and the competent supervisory authorities audit, information and access rights in line with Art. 30(3) DORA.
• Termination — we provide a full data export in open formats (PDF, DOCX, CSV, JSON), confirmed permanent deletion, and transition assistance for 30 days after the contract ends.
• Business continuity — infrastructure in two regions, automatic failover and documented RTO/RPO per plan (section 01). A summary of the continuity arrangements is in the document library.

We distinguish our infrastructure provider's certifications from our own organisation's. The infrastructure layer relies on Google Cloud's certifications. Preparations for DeepTech's own certification are under way. When the report is available, we will publish it here.

Documents marked “In preparation” are drafts. The information highlighted in them is awaiting internal confirmation. The materials below are pending publication; deployment documentation is available on request.