GDPR and EU AI Act
Your compliance questions, answered by article.
Each article we build against is mapped to the control that addresses it, and each control's status is published on the control board.
Documents stored in the EU
AI processing in France, AI models from EEA-incorporated vendors. Every processor is published in our sub-processor register with its jurisdiction and transfer basis.
GDPR by design
Data minimization, access control, and tenant isolation are built into the architecture.
EU AI Act
Append-only logging of questions, source citations on answers from your documents, and each obligation's status on the control board.
EU AI Act · Articles 12 to 14
Logging, transparency and oversight under the AI Act.
Articles 12 to 14 set logging, transparency and human-oversight duties for high-risk AI systems. The control board shows how far Nordvec meets each of them today.
Automatic event logging
[Article 12]Each answered question writes an audit entry with its time, the number of sources and the documents it cited.
Transparency for users
[Article 13]A published page states what the assistant can and cannot do, and answers from your documents cite their sources.
Human oversight
[Article 14]Members whose role has the audit-log permission can review who asked what and when. This obligation is not yet verified on the control board.
Exportable documentation
[Articles 12 to 14]Export the audit trail as CSV, or as JSON with the proof that places each entry in the hash chain.
GDPR · Data subject rights
Data subject rights in your settings.
Access, portability and erasure run from your settings. Rectification, restriction and objection are requests you file in the same place, answered within one month (Art. 12(3)).
Right to erasure
[Article 17]Deleting your account freezes it at once. After a window in which you can cancel, a background job erases your personal data, documents, embeddings, AI history and stored files, and issues an erasure receipt.
Data portability
[Article 20]Export your documents, conversations, AI interactions and memories as structured JSON. Embeddings are left out because they are derived from your documents.
Right of access
[Article 15]The self-service export lists every section your account holds, with the purpose and retention period of each (Art. 15(1)).
Privacy by design
[Article 25]Tenant isolation in the database, and a connector's content stays private to the person who connected it until they share it.
No automated decisions
[Article 22]Nordvec's answers are advice for a person to read. It makes no decision about an individual, and answers from your documents cite their sources.
Audit trail
[Article 5(2)]Append-only audit logs record document views, questions and administrative actions, and hash-chained hourly checkpoints make tampering detectable. Export them for a data protection officer or a regulator.
Storage limitation
[Article 5(1)(e)]A nightly job deletes documents that have stayed in the trash past their retention period, and per-source retention settings delete older synced content.
EU AI Act
Where each AI Act obligation stands
See which AI Act obligations Nordvec has implemented, which are still partial, and the evidence behind each.
Data residency
Documents and AI processing in the EU.
Use one assistant whose questions and cited documents stay in an audit trail you can export.
An append-only audit trail
Questions, document views and administrative actions are written to an append-only audit trail you can filter and export.
- Answered questions and the documents they cited
- Data sources accessed per query
- Visible to members whose role has the audit-log permission
- A timestamp on every entry
- Export as CSV or as verifiable JSON
Check it with your own documents.
The obligations on this page describe the product you would use, with the evidence linked for each.