{ "lastModified": "2026-10-05T22:59:10.000Z", "version": 1, "evaluatedAgainst": { "subprocessors": 12, "frameworks": 39 }, "totals": { "publishable": 10, "blocked": 3, "earnedUnstated": 0 }, "claims": [ { "id": "connector-residency-labels", "assertion": "Per-layer sentences on every connector card naming the countries a synced source's content is stored, inferred over and routed through.", "kind": "register-derived-label", "instrument": "GDPR Art. 13(1)(e)", "status": "publishable", "reason": "rendered from the register in apps/web/components/integrations/IntegrationCardParts.tsx, so it cannot assert more than the row it labels.", "counterexamples": [], "commitment": null }, { "id": "documents-and-ai-in-eu", "assertion": "Customer documents are stored, and the model calls that read them run, only in EU member states.", "kind": "vendor-processes-in", "instrument": "GDPR Art. 44", "status": "publishable", "reason": "2 named vendor(s) process only in AT, BE, BG, HR, CY, CZ, DK, EE, FI, FR, DE, GR, HU, IE, IT, LV, LT, LU, MT, NL, PL, PT, RO, SK, SI, ES, SE.", "counterexamples": [], "commitment": null }, { "id": "documents-stored-in-ireland", "assertion": "Customer documents are stored in Ireland, an EEA region.", "kind": "vendor-processes-in", "instrument": "GDPR Art. 30(1)(d)-(e)", "status": "publishable", "reason": "1 named vendor(s) process only in IE.", "counterexamples": [], "commitment": null }, { "id": "eaa-presumption-of-conformity", "assertion": "Nordvec conforms to the harmonised standard EN 301 549 and is therefore presumed to meet the European Accessibility Act.", "kind": "presumption-of-conformity", "instrument": "Directive (EU) 2019/882, Art. 15", "status": "blocked", "reason": "no Official Journal citation of en-301-549 under Directive (EU) 2019/882 is recorded, so no version of it confers a presumption under that act.", "counterexamples": [ "en-301-549" ], "commitment": null }, { "id": "eu-ai-act-fully-implemented", "assertion": "Nordvec meets every EU AI Act obligation.", "kind": "framework-fully-implemented", "instrument": "Regulation (EU) 2024/1689", "status": "blocked", "reason": "15 of 16 distilled obligations for eu-ai-act are not implemented: robustness-cybersecurity (partial); data-governance (unverified); deployer-duties (unverified); gpai-upstream-docs (unverified); human-oversight (unverified); fundamental-rights-impact (unverified); +9 more.", "counterexamples": [ "robustness-cybersecurity", "data-governance", "deployer-duties", "gpai-upstream-docs", "human-oversight", "fundamental-rights-impact", "registration-post-market", "prohibited-practices", "provider-instructions", "record-keeping-logs", "risk-classification", "ai-content-marking", "ai-interaction-transparency", "right-to-explanation", "value-chain-role" ], "commitment": null }, { "id": "evidence-tier-legend", "assertion": "The trust board's evidence legend describes what the corpus verifier checks for each evidence kind: a dated production assessment, a live artifact with a stated review date inside the review window, a wired gate, a test that is not skipped, and a source reference that proves existence only.", "kind": "verifier-derived-label", "instrument": "UCPD 2005/29/EC Art. 6(1)(b)", "status": "publishable", "reason": "describes the check implemented in packages/compliance-intelligence/src/verify.ts, which the gate holds the citation against.", "counterexamples": [], "commitment": null }, { "id": "inference-in-france", "assertion": "The model calls that read customer content (generation and embeddings) run in France.", "kind": "vendor-processes-in", "instrument": "GDPR Art. 44", "status": "publishable", "reason": "1 named vendor(s) process only in FR.", "counterexamples": [], "commitment": null }, { "id": "no-training-flowed-down-to-model-vendors", "assertion": "Our no-training commitment is contractually flowed down to the model vendors, not merely promised by us.", "kind": "no-training-flowed-down", "instrument": "GDPR Art. 28(3)(a)", "status": "publishable", "reason": "a no-training commitment flowed down to the vendor holds across 1 vendor(s) in inference.", "counterexamples": [], "commitment": null }, { "id": "security-page-framework-standing", "assertion": "The status line on the GDPR and EU AI Act cards of the security page is the framework's corpus standing, and reads Implemented only when every distilled obligation is.", "kind": "snapshot-derived-label", "instrument": "UCPD 2005/29/EC Art. 6(1)(b)", "status": "publishable", "reason": "rendered from the trust snapshot in apps/web/app/[locale]/(marketing)/security/page.tsx, so it states the corpus tally and nothing past it.", "counterexamples": [], "commitment": null }, { "id": "sovereign-model-supply-chain", "assertion": "No vendor in the model layer, and no parent of one, is incorporated outside the EEA.", "kind": "no-third-country-entity", "instrument": "GDPR Chapter V", "status": "publishable", "reason": "EEA-only corporate jurisdiction holds across 1 vendor(s) in inference.", "counterexamples": [], "commitment": null }, { "id": "sovereign-supply-chain", "assertion": "No vendor that processes customer content, and no parent of one, is incorporated outside the EEA.", "kind": "no-third-country-entity", "instrument": "GDPR Chapter V", "status": "blocked", "reason": "EEA-only corporate jurisdiction is refuted in storage, inference, transit, telemetry, communications by: supabase (US); upstash (US); cloudflare (US); sentry (US); vercel (US).", "counterexamples": [ "supabase", "upstash", "cloudflare", "sentry", "vercel" ], "commitment": { "target": "Before launch. Launch is gated on the infrastructure roadmap: no vendor the sub-processor register marks inTargetStack=false may process customer content when we open to customers.", "planPath": "docs/plans/infrastructure-roadmap.md" } }, { "id": "status-legend", "assertion": "The trust board's status legend describes the rules the corpus verifier enforces per status: an implemented control carries evidence beyond a source reference and every citation holds; a partial control may rest on a source reference or on no evidence yet.", "kind": "verifier-derived-label", "instrument": "UCPD 2005/29/EC Art. 6(1)(b)", "status": "publishable", "reason": "describes the check implemented in packages/compliance-intelligence/src/verify.ts, which the gate holds the citation against.", "counterexamples": [], "commitment": null }, { "id": "transfer-basis-labels", "assertion": "Column labels naming each Chapter V transfer basis in the sub-processor disclosure table.", "kind": "register-derived-label", "instrument": "GDPR Art. 28(3)(a)", "status": "publishable", "reason": "rendered from the register in apps/web/app/[locale]/(marketing)/subprocessors/page.tsx, so it cannot assert more than the row it labels.", "counterexamples": [], "commitment": null } ] }