--- title: "Your compliance questions, answered by article." canonical: "https://nordvec.com/compliance" lang: "en" claims: "https://nordvec.com/api/trust/claims" --- # Your compliance questions, answered by article. Source: https://nordvec.com/compliance This file is rendered from the same message catalogue as the page, at request time; the HTML page is the canonical document. Statements about the processing chain are bound to the claim record at https://nordvec.com/api/trust/claims, which says which of them the register currently supports. GDPR and EU AI Act Each article we build against is mapped to the control that addresses it, and each control's status is published on the control board. ### Documents stored in the EU AI processing in France, AI models from EEA-incorporated vendors. Every processor is published in our sub-processor register with its jurisdiction and transfer basis. ### GDPR by design Data minimization, access control, and tenant isolation are built into the architecture. ### EU AI Act Append-only logging of questions, source citations on answers from your documents, and each obligation's status on the control board. ## Logging, transparency and oversight under the AI Act. *EU AI Act · Articles 12 to 14* Articles 12 to 14 set logging, transparency and human-oversight duties for high-risk AI systems. The control board shows how far Nordvec meets each of them today. ### Automatic event logging (Article 12) **How does Nordvec handle AI event logging under the EU AI Act?** Each answered question writes an audit entry with its time, the number of sources and the documents it cited. Requires high-risk AI systems to record events automatically over their lifetime. ### Transparency for users (Article 13) **How does Nordvec provide AI transparency to users?** A published page states what the assistant can and cannot do, and answers from your documents cite their sources. Requires providers of high-risk AI systems to give deployers instructions for use, including purpose, accuracy, limitations and foreseeable misuse. ### Human oversight (Article 14) **How does Nordvec ensure human oversight of AI systems?** Members whose role has the audit-log permission can review who asked what and when. This obligation is not yet verified on the control board. Requires that high-risk AI systems can be effectively overseen by trained, authorized natural persons, with the ability to understand, monitor, and intervene. ### Exportable documentation (Articles 12 to 14) **Can Nordvec export AI compliance documentation for regulators?** Export the audit trail as CSV, or as JSON with the proof that places each entry in the hash chain. For high-risk AI systems, providers keep technical documentation for 10 years (Art. 18) and logs for at least six months (Art. 19). ## Data subject rights in your settings. *GDPR · Data subject rights* Access, portability and erasure run from your settings. Rectification, restriction and objection are requests you file in the same place, answered within one month (Art. 12(3)). ### Right to erasure (Article 17) Deleting your account freezes it at once. After a window in which you can cancel, a background job erases your personal data, documents, embeddings, AI history and stored files, and issues an erasure receipt. Data subjects can have their personal data erased without undue delay where an Article 17(1) ground applies. ### Data portability (Article 20) Export your documents, conversations, AI interactions and memories as structured JSON. Embeddings are left out because they are derived from your documents. Data subjects have the right to receive their personal data in a structured, commonly used, and machine-readable format. ### Right of access (Article 15) The self-service export lists every section your account holds, with the purpose and retention period of each (Art. 15(1)). Data subjects have the right to obtain confirmation of whether their data is being processed and access to that data. ### Privacy by design (Article 25) Tenant isolation in the database, and a connector's content stays private to the person who connected it until they share it. Controllers must implement appropriate technical and organisational measures designed to protect data from the outset. ### No automated decisions (Article 22) Nordvec's answers are advice for a person to read. It makes no decision about an individual, and answers from your documents cite their sources. Data subjects have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. ### Audit trail (Article 5(2)) Append-only audit logs record document views, questions and administrative actions, and hash-chained hourly checkpoints make tampering detectable. Export them for a data protection officer or a regulator. The controller is responsible for, and must be able to demonstrate, compliance with the processing principles (accountability). ### Storage limitation (Article 5(1)(e)) A nightly job deletes documents that have stayed in the trash past their retention period, and per-source retention settings delete older synced content. Personal data must not be kept longer than necessary for the purposes for which it is processed. ## Where each AI Act obligation stands *EU AI Act* See which AI Act obligations Nordvec has implemented, which are still partial, and the evidence behind each. [Explore EU AI Act details](/eu-ai-act) ## Documents and AI processing in the EU. *Data residency* Use one assistant whose questions and cited documents stay in an audit trail you can export. [Read about data residency](/data-sovereignty) ## An append-only audit trail Questions, document views and administrative actions are written to an append-only audit trail you can filter and export. - Answered questions and the documents they cited - Data sources accessed per query - Visible to members whose role has the audit-log permission - A timestamp on every entry - Export as CSV or as verifiable JSON **Every question, document view and admin action becomes an append-only audit entry, which you can export** - A question - A document view - An admin action - **Nordvec**: Logs each one as it happens - **An append-only trail**: Timestamped, per member - **An export**: CSV or verifiable JSON ## Check it with your own documents. The obligations on this page describe the product you would use, with the evidence linked for each.