--- title: "The proof behind every answer." canonical: "https://nordvec.com/trust/evidence" lang: "en" claims: "https://nordvec.com/api/trust/claims" --- # The proof behind every answer. Source: https://nordvec.com/trust/evidence This file is rendered from the same message catalogue as the page, at request time; the HTML page is the canonical document. Statements about the processing chain are bound to the claim record at https://nordvec.com/api/trust/claims, which says which of them the register currently supports. Evidence Written for auditors and security reviewers. Each record says how to check it without taking our word for it. **Data as of**: October 19, 2026. **Last reviewed**: September 14, 2026. ## Who can get what - **Public**: Every file on this page. No account and no form. - **On request**: Documents shared by email on request. The set is being finalised, so write to us and name what you need. Machine-readable files for your compliance tooling. OSCAL 1.2.2 is the Open Security Controls Assessment Language, a NIST format for control status. POA&M means plan of action and milestones. ## Control status and claims The files your compliance tooling reads. Each one says how to check it. - [Assessment results](/api/trust/oscal/assessment-results.json) (OSCAL 1.2.2, Public): Every obligation, its status and the evidence it cites, in OSCAL. Check it against NIST's published OSCAL schema, then compare the counts with the control board on this page. - [Plan of action and milestones (POA&M)](/api/trust/oscal/poam.json) (OSCAL 1.2.2, Public): Every open gap, as a plan of action and milestones. Check it against the same OSCAL schema, then match each open item to an obligation that is not yet implemented on the board. - [Claim record, refusals included](/api/trust/claims) (JSON, Public): Every claim we could publish and the verdict on it. Compare each verdict with the provider register and the board it names. - [Hosts each connector may reach](/api/trust/connector-egress) (JSON, Public): The hosts each connector may reach and the layers its content passes through, with a state hash. Recompute the hash over the document without its stateHash field and compare. - [Accessibility conformance report (WCAG 2.2 AA)](/api/trust/accessibility) (JSON, Public): Our WCAG 2.2 AA conformance report. Each criterion lists its result, so you can retest the ones that matter to you. ## Signed records and history Records that are signed or timestamped, and the feed that tells you when any file here changes. - [Signed deployment posture](/api/trust/posture) (JSON, Ed25519-signed, Public): A statement of how this deployment is set up, signed with Ed25519. Fetch the public key from /api/trust/provenance-key and verify the signature over the document. - [Signed deployment posture history](/api/trust/posture-log) (JSON, Ed25519-signed, Public): Every signed posture statement we have published, in order, each linked to the one before it. Verify each signature with the same key and check that the links hold. - [Audit trail checkpoints and timestamps](/api/trust/audit-chain) (JSON, RFC 3161 timestamps, Public): Checkpoints of our audit log, each stamped with an RFC 3161 token, the internet standard for trusted timestamps. Recompute each checkpoint, then check its token with any RFC 3161 tool. - [Subscribe to changes in these documents](/api/trust/changes.atom) (Atom, Public): An Atom feed that announces when a file on this page changes. Subscribe in a feed reader instead of checking by hand. ## Every obligation, with its status and evidence *The control board* The engineering obligations we distilled from the regulations we build against, grouped by country or region. Open a framework to see each obligation, its status and its evidence. We generate the board from a versioned copy of those regulations and map each obligation to the controls that implement it. The mapping is re-run on every change, so a control that is renamed, weakened or deleted loses its status. Obligation texts are shown in English, the language they were distilled and verified in. - 382 obligations, distilled from 39 frameworks - 239 of 382 have code evidence behind them - 94 of 382 are verified as implemented Published control state last changed October 19, 2026 ### How to read the board #### What each status means - **Implemented**: Proven in our code by a test, an automatic check on every change, or a live record, not only by a pointer to the code. - **Partial**: Part of it is in place. We have not checked every element yet, or the only proof so far is a pointer to the code. - **Unverified**: We have identified the rule and mapped it. We have not yet checked our code against it. This is our honest list of gaps. - **Planned**: On the roadmap, not built yet. #### How strong the evidence is - **Assessed**: We tested the control on the running system on a recorded date and it held. This is the only evidence that reports on the live system. - **Artifact**: A document or record that is the control itself and shows it is live: a disclosure channel that is still served, or a policy or procedure with a review date in the last year. A draft or an undated file does not count. - **Gate**: An automatic check that runs on every code change and blocks the change if the control breaks. - **Test**: An automatic test that exercises the control and shows it works. - **Code**: The control exists in our code. That shows it is written, not that it is enforced, so on its own it keeps a control at partial. ### European Union (21 frameworks) #### Critical Entities Resilience Directive (Tier A, 3 obligations) Unverified: 3 - **Notify incidents if designated**: Unverified. No code evidence yet - **Take resilience measures if designated**: Unverified. No code evidence yet - **Determine critical-entity applicability**: Unverified. No code evidence yet #### Cyber Resilience Act (Tier A, 10 obligations) Implemented: 3, Partial: 4, Unverified: 2, Planned: 1 - **Conformity assessment, EU declaration, and CE marking**: Planned. No code evidence yet - **Maintain technical documentation**: Unverified. No code evidence yet - **Protect confidentiality and integrity of data**: Partial. Evidence: Code - **Secure by design and secure by default**: Partial. Evidence: Code - **Report actively exploited vulnerabilities and severe incidents**: Partial. Evidence: Artifact - **Coordinated vulnerability disclosure policy**: Implemented. Evidence: Artifact - **Provide security updates over the support period**: Unverified. No code evidence yet - **Identify and document components (SBOM)**: Implemented. Evidence: Gate - **Monitor upstream components for advisories and record each decision**: Partial. Evidence: Gate - **Identify and address vulnerabilities without delay**: Implemented. Evidence: Gate #### Misleading and Comparative Advertising Directive (Tier A, 6 obligations) Implemented: 4, Partial: 2 - **Compare only products that meet the same needs or serve the same purpose**: Partial. Evidence: Test - **Make no comparison that is misleading about either product**: Implemented. Evidence: Test - **Neither discredit the competitor nor trade on its marks**: Partial. Evidence: Test - **Compare material, relevant, verifiable and representative features, objectively**: Implemented. Evidence: Test - **Keep every comparison current, because cessation needs no proof of loss**: Implemented. Evidence: Gate - **Treat any sentence that identifies another product as comparative advertising**: Implemented. Evidence: Gate #### EU Cybersecurity Act (Tier A, 4 obligations) Partial: 2, Unverified: 2 - **Monitor the certification framework for a relevant or mandatory scheme**: Unverified. No code evidence yet - **Understand the basic-level self-assessment route**: Unverified. No code evidence yet - **Publish supplementary cybersecurity information if certified**: Partial. Evidence: Code - **Hold the security objectives a certification scheme would require**: Partial. Evidence: Artifact #### Data Governance Act (Tier A, 3 obligations) Partial: 1, Unverified: 2 - **Notify and meet neutrality conditions if providing intermediation**: Unverified. No code evidence yet - **Determine data-intermediation / altruism applicability**: Unverified. No code evidence yet - **Safeguard protected data against unlawful international transfer**: Partial. Evidence: Code #### Digital Operational Resilience Act (Tier A, 10 obligations) Partial: 4, Unverified: 5, Planned: 1 - **ICT governance and accountability**: Unverified. No code evidence yet - **Anomalous-activity detection**: Partial. Evidence: Code - **Protection and prevention controls**: Partial. Evidence: Code - **Response, recovery, and backup**: Unverified. No code evidence yet - **Classify and report major incidents to customers**: Partial. Evidence: Artifact - **ICT incident management process**: Partial. Evidence: Artifact - **Cyber-threat information sharing (optional)**: Unverified. No code evidence yet - **Support digital operational resilience testing**: Unverified. No code evidence yet - **Subcontracting and concentration-risk transparency**: Unverified. No code evidence yet - **DORA Art 30 contractual provisions**: Planned. No code evidence yet #### Digital Services Act (Tier A, 7 obligations) Implemented: 5, Unverified: 2 - **Let anyone notify allegedly illegal content**: Implemented. Evidence: Artifact Known limit: A failed notification mail is not retried automatically. - **Report suspected threats to life or safety**: Implemented. Evidence: Artifact - **Give a statement of reasons for every restriction**: Implemented. Evidence: Artifact Known limit: A failed notification mail is not retried automatically. - **Classify the service: hosting service, not an online platform**: Unverified. No code evidence yet - **Publish single points of contact for authorities and for users**: Implemented. Evidence: Artifact - **State usage restrictions and moderation in the terms**: Implemented. Evidence: Test Known limit: The translated terms have no clause-by-clause legal review. - **Annual transparency report, exempt while a micro or small enterprise**: Unverified. No code evidence yet #### Data Act (Tier A, 6 obligations) Partial: 4, Unverified: 2 - **Use open, documented formats for exported data**: Partial. No code evidence yet - **Export customer data in a structured, common, machine-readable format**: Partial. Evidence: Code - **Safeguard against unlawful third-country governmental access**: Partial. Evidence: Code - **Remove switching and data-egress charges**: Unverified. No code evidence yet - **Enable customers to switch or terminate the service**: Unverified. No code evidence yet - **Publish where customer data is processed and stored**: Partial. Evidence: Code #### European Accessibility Act (Tier A, 5 obligations) Partial: 3, Unverified: 2 - **Design and provide the service to the accessibility requirements**: Partial. Evidence: Gate - **Document any disproportionate-burden or fundamental-alteration claim**: Unverified. No code evidence yet - **Meet the harmonised standard once it is cited, for presumption of conformity**: Partial. Evidence: Gate - **Publish an accessibility statement (how the service meets the requirements)**: Partial. Evidence: Code - **Determine EAA scope and the microenterprise service-provider exemption**: Unverified. No code evidence yet #### EU Artificial Intelligence Act (Tier A, 16 obligations) Implemented: 1, Partial: 5, Unverified: 10 - **Ensure accuracy, robustness and cybersecurity (Art 15)**: Partial. No code evidence yet - **Data and data governance for high-risk (Art 10)**: Unverified. No code evidence yet - **Promote a sufficient level of AI literacy in staff operating the AI system**: Implemented. Evidence: Artifact - **Deployer obligations for high-risk use (Art 26)**: Unverified. No code evidence yet - **Consume upstream GPAI provider documentation**: Unverified. No code evidence yet - **Design for human oversight (Art 14)**: Unverified. No code evidence yet - **Fundamental-rights impact assessment (Art 27)**: Unverified. No code evidence yet - **Registration and post-market monitoring (Art 49, 72)**: Unverified. No code evidence yet - **Never implement prohibited AI practices**: Partial. No code evidence yet - **Provide instructions and information to deployers (Art 13)**: Unverified. No code evidence yet - **Automatic record-keeping / logging (Art 12)**: Partial. Evidence: Code - **Classify the system's risk tier and record it**: Unverified. No code evidence yet - **Mark AI-generated content (Art 50)**: Partial. Evidence: Test - **Disclose AI interaction to users (Art 50)**: Partial. Evidence: Code - **Support the right to explanation (Art 86)**: Unverified. No code evidence yet - **Determine and manage our AI-value-chain role**: Unverified. No code evidence yet #### Data Protection Regulation for EU Institutions (Tier A, 5 obligations) Implemented: 1, Partial: 3, Unverified: 1 - **Support data-subject access and erasure**: Implemented. Evidence: Test - **Maintain records of processing activities**: Partial. No code evidence yet - **Support EU-institution customers as an EUDPR processor**: Unverified. No code evidence yet - **Apply appropriate security of processing**: Partial. Evidence: Code - **Restrict international transfers to lawful bases**: Partial. Evidence: Code #### EU Employee-Monitoring and Works-Council Requirements (Tier A, 6 obligations) Implemented: 3, Partial: 2, Unverified: 1 - **Give the controller the technical facts it needs for its DPIA and works-council process**: Implemented. Evidence: Artifact - **Design org-wide connection as a deliberate, acknowledged administrator action**: Unverified. No code evidence yet - **Offer minimization levers the controller can invoke to keep its assessment defensible**: Partial. Evidence: Artifact - **Allocate employment-law compliance to the controller in the DPA and name the instruments**: Implemented. Evidence: Artifact - **Process connected employee data only on documented controller instruction**: Implemented. Evidence: Artifact - **Provide in-product transparency surfaces and an admin compliance kill-switch**: Partial. Evidence: Test #### General Data Protection Regulation (Tier A, 32 obligations) Implemented: 10, Partial: 16, Unverified: 4, Planned: 2 - **Demonstrate controller accountability**: Partial. No code evidence yet - **Data protection by design and by default**: Partial. No code evidence yet - **Run a DPIA for high-risk processing**: Unverified. No code evidence yet - **Assess and document whether a Data Protection Officer must be designated**: Partial. No code evidence yet - **Synthetic or anonymised data outside production**: Implemented. Evidence: Artifact Known limit: The check reads the repository, not a running database. - **Maintain records of processing activities (ROPA)**: Implemented. Evidence: Artifact - **Constrain solely-automated decisions**: Unverified. No code evidence yet - **Communicate erasure and rectification to every recipient**: Partial. No code evidence yet - **Suspend erasure under a legal hold, fail-closed**: Planned. No code evidence yet - **Fulfil right of access (export of a data subject's data)**: Implemented. Evidence: Test - **Fulfil right to erasure across all stores**: Partial. Evidence: Test - **Honour objection to processing**: Partial. Evidence: Test - **Fulfil right to data portability**: Implemented. Evidence: Test - **Fulfil right to rectification**: Partial. Evidence: Test - **Fulfil right to restriction of processing**: Partial. Evidence: Test - **Document whether the service is offered to children and gate consent accordingly**: Partial. No code evidence yet - **Capture and allow withdrawal of consent**: Implemented. Evidence: Artifact - **Record a lawful basis per processing purpose**: Unverified. No code evidence yet - **Bind processors and subprocessors**: Partial. Evidence: Code - **Return or delete all personal data on contract termination**: Planned. No code evidence yet - **Enforce storage limitation and retention**: Partial. Evidence: Code - **Detect and notify personal data breaches**: Partial. Evidence: Artifact - **Continuously assure access-control enforcement**: Partial. Evidence: Test - **Scope ingestion credentials to least privilege**: Implemented. Evidence: Assessed - **Enforce document permissions at query time**: Implemented. Evidence: Test - **Resolve group access at query time**: Implemented. Evidence: Test - **Apply appropriate technical + organisational security**: Implemented. Evidence: Artifact Known limit: A database timing side channel is an accepted residual risk, with compensating controls. - **Enforce tenant isolation as a security measure**: Implemented. Evidence: Assessed - **Attribute customer-directed transfers (webhook destinations) correctly**: Partial. Evidence: Artifact - **Keep personal data in the EU / lawful-transfer only**: Partial. Evidence: Code - **State the AI processing of personal data in the privacy notice**: Unverified. No code evidence yet - **Serve a transparent privacy notice**: Partial. Evidence: Code #### Network and Information Security Directive 2 (Tier A, 12 obligations) Implemented: 1, Partial: 6, Unverified: 5 - **Management accountability for cybersecurity**: Unverified. No code evidence yet - **Report significant incidents on the NIS2 clock**: Partial. Evidence: Artifact - **Register as an entity where required**: Unverified. No code evidence yet - **Access control, MFA, and asset management**: Partial. Evidence: Code - **Business continuity, backup, and crisis management**: Unverified. No code evidence yet - **Cryptography and encryption**: Partial. No code evidence yet - **Cyber hygiene and training**: Unverified. No code evidence yet - **Incident handling**: Partial. Evidence: Artifact - **Assess effectiveness of security measures**: Partial. Evidence: Assessed - **Risk analysis and information-security policy**: Unverified. No code evidence yet - **Secure development and vulnerability handling**: Implemented. Evidence: Artifact - **Supply-chain security**: Partial. Evidence: Code #### NIS2 Technical and Methodological Measures (Implementing Regulation) (Tier A, 5 obligations) Partial: 1, Unverified: 4 - **Apply the cloud/managed-service availability + integrity thresholds**: Unverified. No code evidence yet - **Aggregate recurring minor incidents into one significant incident**: Unverified. No code evidence yet - **Classify incidents against the significant-incident criteria (starts the Art 23 clock)**: Unverified. No code evidence yet - **Count user impact per the prescribed method**: Unverified. No code evidence yet - **Apply the Annex technical and methodological measures, proportionately and documented**: Partial. Evidence: Artifact #### Product Liability Directive (revised) (Tier A, 6 obligations) Partial: 4, Unverified: 2 - **Safeguard user data against corruption and loss**: Partial. Evidence: Code - **Preserve records so relevant evidence can be disclosed**: Partial. Evidence: Artifact - **Track substantial modifications and manufacturer-role changes**: Unverified. No code evidence yet - **Meet safety-relevant cybersecurity requirements to avoid presumed defectiveness**: Partial. Evidence: Artifact - **Determine PLD scope for the software product and related services**: Unverified. No code evidence yet - **Supply the security updates needed to maintain safety**: Partial. Evidence: Code #### Unfair Commercial Practices Directive (Tier A, 6 obligations) Implemented: 4, Partial: 2 - **Market without creating confusion with a competitor's products or marks**: Implemented. Evidence: Test - **Publish none of the per-se unfair practices**: Implemented. Evidence: Artifact - **Publish no false or deceptive statement about the product, the price or the trader**: Partial. Evidence: Test - **State the material information at the invitation to purchase**: Partial. Evidence: Code - **Treat every published marketing sentence as a B2C commercial practice**: Implemented. Evidence: Gate - **Hold the evidence for every factual marketing claim, ready on demand**: Implemented. Evidence: Gate #### Voluntary Sustainability Reporting Standard for SMEs (VSME) (Tier A, 30 obligations) Implemented: 1, Unverified: 29 - **B3: report total energy consumption**: Unverified. No code evidence yet - **B3: report estimated gross scope 1 and scope 2 greenhouse gas emissions**: Unverified. No code evidence yet - **B4: report pollution of air, water and soil**: Unverified. No code evidence yet - **B5: disclose sites in or near biodiversity-sensitive areas**: Unverified. No code evidence yet - **B6: report water withdrawal and, where relevant, consumption**: Unverified. No code evidence yet - **B7: report circular economy practice and waste**: Unverified. No code evidence yet - **B1: state the basis for preparation**: Unverified. No code evidence yet - **B1: describe sustainability certifications and labels held**: Unverified. No code evidence yet - **B1: report the undertaking's identifying and size data**: Unverified. No code evidence yet - **B2: state sustainability practices, policies and future initiatives**: Unverified. No code evidence yet - **B11: report anti-corruption and anti-bribery convictions and fines**: Unverified. No code evidence yet - **B10: report pay floor, collective bargaining and training**: Unverified. No code evidence yet - **B8: report workforce characteristics**: Unverified. No code evidence yet - **B9: report work-related accidents**: Unverified. No code evidence yet - **Comprehensive module: consider scope 3 emissions alongside B3**: Unverified. No code evidence yet - **C3: report greenhouse gas reduction targets and any transition plan**: Unverified. No code evidence yet - **C4: report climate-related hazards and transition risks**: Unverified. No code evidence yet - **C1: describe the business model and strategy**: Unverified. No code evidence yet - **C2: describe the B2 practices, policies and initiatives in more detail**: Unverified. No code evidence yet - **C8: report revenues from sensitive sectors**: Unverified. No code evidence yet - **C9: report the gender diversity ratio of the governance body**: Unverified. No code evidence yet - **C5: report employee turnover and optional workforce detail**: Unverified. No code evidence yet - **C6: report human rights policies and the complaints mechanism**: Unverified. No code evidence yet - **C7: report confirmed human rights incidents**: Unverified. No code evidence yet - **Keep what a sustainability report says apart from what marketing may claim**: Implemented. Evidence: Gate - **Prepare a report that is relevant, comparable and consistent with the financial statements**: Unverified. No code evidence yet - **Use the standard only as a voluntary, modular framework**: Unverified. No code evidence yet - **Track the dates the regulation and its cap apply from**: Unverified. No code evidence yet - **Treat Recommendation (EU) 2025/1710 as no longer in effect**: Unverified. No code evidence yet - **Answer reporting customers within the value chain cap**: Unverified. No code evidence yet #### Electronic Identification and Trust Services Regulation (Tier A, 4 obligations) Partial: 3, Planned: 1 - **Say which checkpoints carry a stamp, and claim nothing more**: Partial. Evidence: Test - **Anchor audit-chain checkpoints with a qualified electronic time stamp**: Partial. Evidence: Test - **Verify the stamp's binding to the data before relying on it**: Partial. Evidence: Test - **Take stamps only from a provider on an EU trusted list**: Planned. No code evidence yet #### ePrivacy Directive (Tier A, 6 obligations) Implemented: 2, Partial: 2, Unverified: 2 - **Confidentiality of communications and usage**: Partial. Evidence: Code - **Consent before non-essential storage or access on the user's device**: Implemented. Evidence: Artifact - **Erase or anonymise traffic data when no longer needed**: Unverified. No code evidence yet - **Opt-in for unsolicited electronic marketing**: Implemented. Evidence: Artifact - **Apply GDPR where ePrivacy is silent**: Unverified. No code evidence yet - **Security of the service**: Partial. Evidence: Artifact #### EN 301 549 Accessibility Requirements for ICT (Tier B, 1 obligations) Partial: 1 Grounded via the public wcag-2-2 crosswalk anchor; the proprietary standard's text is never stored. - **Meet the clause 9 web requirements of the version we engineer to**: Partial. Evidence: Gate ### International (10 frameworks) #### OWASP Application Security Verification Standard (Tier A, 10 obligations) Implemented: 4, Partial: 5, Unverified: 1 - **Rate limiting and anti-automation controls**: Implemented. Evidence: Test - **Protect authentication against brute force and offer MFA**: Unverified. No code evidence yet - **Enforce function- and data-level authorization at a trusted layer**: Implemented. Evidence: Assessed - **Classify sensitive data and bound its retention**: Partial. Evidence: Code - **Validate uploaded files by type, extension, and size**: Implemented. Evidence: Test - **Prevent injection via parameterized queries and safe OS calls**: Partial. No code evidence yet - **Protect against Server-Side Request Forgery**: Implemented. Evidence: Test - **Structured security logging with correlation and no sensitive data**: Partial. Evidence: Code - **Context-aware output encoding and sanitization of rendered content**: Partial. No code evidence yet - **Manage third-party components with remediation timeframes and an SBOM**: Partial. Evidence: Gate #### OWASP Top 10 for Large Language Model Applications (Tier A, 10 obligations) Implemented: 3, Partial: 7 - **Constrain agent functionality, permissions, and autonomy**: Partial. Evidence: Code - **Protect training/RAG data integrity against poisoning**: Partial. Evidence: Gate - **Prevent unauthorized retrieval of sensitive data from the knowledge base**: Implemented. Evidence: Test - **Partition the vector store per tenant with permission-aware retrieval**: Implemented. Evidence: Test - **Ground answers and surface source citations to counter hallucination**: Partial. Evidence: Code - **Mitigate direct and indirect prompt injection**: Partial. Evidence: Gate - **Handle model output as untrusted before downstream use**: Partial. Evidence: Code - **Keep secrets and authorization out of the system prompt**: Partial. Evidence: Test - **Bound inference consumption with rate limits and quotas**: Implemented. Evidence: Test Known limit: Three AI-specific threat classes are ranked low and are not addressed. - **Secure the model and dependency supply chain**: Partial. Evidence: Gate #### OWASP Top 10 (Tier A, 10 obligations) Implemented: 3, Partial: 7 - **Prevent broken access control**: Implemented. Evidence: Assessed - **Harden identification and authentication**: Partial. Evidence: Code - **Avoid security misconfiguration**: Partial. Evidence: Code - **Protect data with sound cryptography**: Partial. No code evidence yet - **Prevent injection**: Partial. No code evidence yet - **Protect software and data integrity**: Partial. Evidence: Code - **Ensure security logging and monitoring**: Partial. Evidence: Artifact - **Address insecure design**: Partial. No code evidence yet - **Prevent Server-Side Request Forgery**: Implemented. Evidence: Test - **Manage vulnerable and outdated components**: Implemented. Evidence: Gate #### Web Content Accessibility Guidelines 2.2 (Tier A, 2 obligations) Partial: 1, Unverified: 1 - **Enforce an automated WCAG 2.2 AA scan over key surfaces in CI**: Partial. Evidence: Gate - **Audit key user journeys with assistive technology**: Unverified. No code evidence yet #### CIS Critical Security Controls (Tier B, 33 obligations) Implemented: 13, Partial: 16, Planned: 4 Grounded via the public nist-800-53 crosswalk anchor; the proprietary standard's text is never stored. - **Defined process for granting and revoking access**: Partial. Evidence: Test - **Account inventory, dormancy sweep and separated administrative accounts**: Partial. Evidence: Gate - **Multi-factor authentication on exposed and administrative access**: Partial. Evidence: Test - **Role-based access control that is defined, not implied**: Partial. No code evidence yet - **Application security testing on every change**: Partial. Evidence: Gate - **A secure development process with root-cause analysis and secure design defaults**: Implemented. Evidence: Artifact - **Vetted components for security functions rather than hand-rolled ones**: Implemented. Evidence: Test - **Audit logs collected somewhere other than the host that wrote them**: Planned. No code evidence yet - **Stated logging requirements, a retention window, and review of what is logged**: Partial. Evidence: Gate - **Audit logging of access to sensitive data**: Partial. Evidence: Test - **Data classification and documented data flows**: Partial. Evidence: Artifact - **A data-management process and an inventory of the sensitive data held**: Implemented. Evidence: Artifact - **Enforced retention and disposal**: Implemented. Evidence: Test Known limit: A cached copy of derived data can briefly outlive a deleted document. - **Encryption of data at rest**: Partial. Evidence: Test - **Encryption of data in transit**: Partial. Evidence: Test - **Encryption of data at rest on end-user devices**: Implemented. Evidence: Test - **Access control lists scoped to the data owner**: Implemented. Evidence: Assessed - **Automated backups with recovery actually tested**: Planned. No code evidence yet - **Authenticated sending domain for outbound mail**: Planned. No code evidence yet - **Routine exercises of the incident-response process**: Implemented. Evidence: Artifact - **An incident-response process with a named owner, a reporting route and a review step**: Partial. Evidence: Artifact - **Malware defences over the content the product ingests**: Implemented. Evidence: Test - **A penetration-testing programme, including as an authenticated user**: Planned. No code evidence yet - **Separated production, staging and development environments**: Partial. Evidence: Test - **Standard hardening templates for the application infrastructure**: Partial. No code evidence yet - **Assessment of service providers against their classification**: Implemented. Evidence: Artifact - **Decommissioning a service provider**: Implemented. Evidence: Gate - **Risk classification of service providers**: Implemented. Evidence: Artifact - **Security requirements in service provider arrangements**: Partial. Evidence: Gate - **Inventory of third-party components and service providers**: Partial. Evidence: Gate - **Vulnerability management process for the software we ship**: Implemented. Evidence: Artifact - **Patching and vulnerability scanning of the hosts we will run**: Partial. No code evidence yet - **A published intake channel for vulnerability reports, and a severity scale behind it**: Implemented. Evidence: Artifact #### ISO 15489 Records Management (Tier B, 6 obligations) Implemented: 6 Grounded via the public nist-800-53 crosswalk anchor; the proprietary standard's text is never stored. - **Audit records cannot be silently altered once captured**: Implemented. Evidence: Test - **Every auditable event is captured with typed, enumerated metadata**: Implemented. Evidence: Test - **Records stay retrievable to authorised reviewers throughout retention**: Implemented. Evidence: Test - **Audit logs are purged on a fixed, floored schedule**: Implemented. Evidence: Test - **Every destructive action leaves a reason-coded, honest receipt**: Implemented. Evidence: Test - **Raw telemetry is frozen to a long-lived ledger before it is purged**: Implemented. Evidence: Test #### ISO/IEC 25012 Data Quality Model (Tier B, 6 obligations) Implemented: 5, Partial: 1 Grounded via the public gdpr crosswalk anchor; the proprietary standard's text is never stored. - **Data accuracy: extracted content faithfully represents the source**: Implemented. Evidence: Test - **Data completeness: every ingested document is searchable or visibly failed**: Implemented. Evidence: Test - **Data consistency: derived stores agree with the document they describe**: Implemented. Evidence: Test - **Data currentness: the index tracks the source over time**: Implemented. Evidence: Test Known limit: No measured target yet for how old the search index may be. - **Data confidentiality: content is reachable only by authorised principals**: Partial. Evidence: Code - **Data traceability: retrieved content is attributable to its source**: Implemented. Evidence: Test #### ISO/IEC 27001 Information Security Management Systems (Tier B, 16 obligations) Implemented: 5, Partial: 9, Unverified: 2 Grounded via the public nist-800-53 crosswalk anchor; the proprietary standard's text is never stored. - **Access control on a need-to-use basis**: Implemented. Evidence: Assessed - **ICT readiness for business continuity**: Unverified. No code evidence yet - **Security for the use of cloud services**: Unverified. No code evidence yet - **Provision and revoke access rights over the lifecycle**: Partial. Evidence: Artifact - **Information security incident management**: Partial. Evidence: Artifact - **Security requirements inside supplier agreements**: Implemented. Evidence: Gate - **Security in supplier and subprocessor relationships**: Partial. Evidence: Artifact - **Encrypt data in transit and at rest under managed key policy**: Partial. No code evidence yet - **Prevent leakage of information**: Partial. Evidence: Artifact - **Restrict access to information within applications**: Implemented. Evidence: Assessed - **Security-relevant event logging**: Partial. Evidence: Code - **Monitoring for anomalous behaviour**: Partial. Evidence: Code - **Secure authentication including MFA**: Partial. Evidence: Artifact - **Secure coding and application security testing**: Implemented. Evidence: Gate - **Secure development lifecycle**: Partial. Evidence: Code - **Track and remediate technical vulnerabilities on a defined cadence**: Implemented. Evidence: Artifact #### ISO/IEC 27701 Privacy Information Management (Tier B, 10 obligations) Implemented: 1, Partial: 3, Unverified: 5, Planned: 1 Grounded via the public nist-800-53 crosswalk anchor; the proprietary standard's text is never stored. - **Obtain and allow withdrawal of consent**: Unverified. No code evidence yet - **Fulfil PII principals' access, correction, and erasure rights**: Implemented. Evidence: Test - **Record and control transfers of PII**: Unverified. No code evidence yet - **Privacy by design and by default**: Partial. Evidence: Code - **Identify purposes and lawful basis for processing PII**: Unverified. No code evidence yet - **Limit retention and dispose of PII**: Partial. Evidence: Code - **Provide transparency information to PII principals**: Unverified. No code evidence yet - **Notify controllers of privacy incidents**: Partial. Evidence: Artifact - **Maintain records of PII processing**: Unverified. No code evidence yet - **Process customer PII only on documented instructions**: Planned. No code evidence yet #### ISO/IEC 42001 AI Management System (Tier B, 10 obligations) Partial: 6, Unverified: 4 Grounded via the public eu-ai-act crosswalk anchor; the proprietary standard's text is never stored. - **Manage the AI system life cycle responsibly**: Unverified. No code evidence yet - **Keep records and logs of AI operation**: Partial. Evidence: Code - **Ensure AI robustness, accuracy, and security**: Partial. Evidence: Code - **Govern data used by AI systems**: Partial. Evidence: Code - **Provide information about AI systems to interested parties**: Partial. Evidence: Code - **Assess impacts of AI systems on individuals and society**: Unverified. No code evidence yet - **Establish an AI management policy**: Partial. No code evidence yet - **Assign AI roles, responsibilities, and accountability**: Partial. No code evidence yet - **Ensure human oversight of AI use**: Unverified. No code evidence yet - **Manage third-party and model-provider relationships**: Unverified. No code evidence yet ### United States (6 frameworks) #### NIST Generative AI Profile (AI 600-1) (Tier A, 5 obligations) Implemented: 2, Partial: 3 - **Prevent tenant data and system-prompt leakage through generated output**: Partial. Evidence: Test - **Gate abusive and jailbreak input before generation**: Partial. Evidence: Test - **Verify generated claims against the retrieved sources they cite**: Implemented. Evidence: Test - **Mark AI-generated artifacts with machine-readable provenance**: Implemented. Evidence: Test - **Defend the generation pipeline against direct and indirect prompt injection**: Partial. Evidence: Gate #### NIST AI Risk Management Framework (Tier A, 17 obligations) Partial: 11, Unverified: 6 - **Document the AI system's capabilities, knowledge limits, and failure modes**: Unverified. No code evidence yet - **Document the system's intended purpose, context, and requirements**: Unverified. No code evidence yet - **Evaluate fairness and bias in AI output**: Unverified. No code evidence yet - **Maintain an inventory of AI systems and models in use**: Partial. No code evidence yet - **Establish a documented AI risk-management process with periodic review**: Unverified. No code evidence yet - **Encode the trustworthy-AI characteristics into engineering policy**: Partial. No code evidence yet - **Understand and document the AI legal and regulatory requirements we are subject to**: Partial. Evidence: Code - **Define and document human oversight of AI output**: Partial. Evidence: Code - **Provide feedback channels and communicate AI incidents**: Unverified. No code evidence yet - **Measure AI performance with defined test sets and metrics**: Partial. Evidence: Code - **Monitor the AI system after deployment**: Partial. Evidence: Code - **Examine the AI system's privacy risk**: Partial. Evidence: Code - **Assign roles, accountability, and training for AI risk**: Partial. No code evidence yet - **Evaluate AI system security and resilience**: Unverified. No code evidence yet - **Handle failures and incidents in third-party AI dependencies**: Partial. Evidence: Artifact - **Manage third-party and pre-trained model risk**: Partial. Evidence: Code - **Make AI output explainable and traceable to its sources**: Partial. Evidence: Code #### NIST Cybersecurity Framework 2.0 (Tier A, 6 obligations) Partial: 5, Unverified: 1 - **Detect: monitor for and analyze adverse events**: Partial. Evidence: Artifact - **Govern: understand obligations and manage cybersecurity + supply-chain risk**: Partial. Evidence: Artifact - **Identify: inventory assets and identify vulnerabilities**: Partial. Evidence: Code - **Protect: identity, access control, and data security**: Partial. Evidence: Code - **Recover: restore services after an incident**: Unverified. No code evidence yet - **Respond: execute incident response and root-cause analysis**: Partial. Evidence: Artifact #### NIST SP 800-160 Vol. 1 Rev. 1 Engineering Trustworthy Secure Systems (Tier A, 30 obligations) Implemented: 3, Partial: 19, Unverified: 6, Planned: 2 Grounded via the public nist-800-53 crosswalk anchor; the proprietary standard's text is never stored. - **Apply engineering rigor in proportion to the worst consequence**: Partial. Evidence: Gate - **Base every trustworthiness judgment on evidence**: Implemented. Evidence: Gate Known limit: Most evidence shows a control is written, not that it runs. - **Detect departures from design intent early enough to respond**: Partial. Evidence: Gate - **Match the force and speed of a response to the loss scenario**: Partial. Evidence: Artifact - **Give each element the functions it needs and no more**: Partial. Evidence: Test - **Keep resources available only while they are needed**: Implemented. Evidence: Test Known limit: Copies held by providers follow their terms, not our erasure ledger. - **Depend on as few trusted elements as practicable**: Partial. Evidence: Gate - **Reveal as little about the system as practicable**: Partial. Evidence: Code - **Keep the design as simple as practicable**: Partial. Evidence: Gate - **Require more than one party for the most consequential operations**: Unverified. No code evidence yet - **Separate domains with different protection needs**: Implemented. Evidence: Assessed Known limit: Tenants share one database cluster; separation is logical. - **Protect an element only from less trustworthy elements**: Unverified. No code evidence yet - **Allocate each element only the privileges its functions need**: Partial. Evidence: Gate - **Share resources among as few elements as necessary**: Partial. Evidence: Test - **Mediate every access to and operation on an element**: Partial. Evidence: Gate - **Route control functions through a reference monitor**: Partial. Evidence: Assessed - **Scale protection to the worst failure of the element protected**: Partial. Evidence: Test - **Trust an element only as far as its failure could cost**: Partial. Evidence: Artifact - **Keep protection unbroken for as long as it is needed**: Partial. Evidence: Test - **Layer independent mechanisms so one failure is not the loss**: Partial. Evidence: Test - **Operate well clear of the threshold where loss begins**: Partial. Evidence: Code - **Ship the most protective configuration as the default**: Partial. Evidence: Test - **Fail into a safe state**: Partial. Evidence: Test - **Recover without causing or leading to loss**: Planned. No code evidence yet - **Replicate critical functions where loss would be severe**: Planned. No code evidence yet - **Keep the abstractions that describe the system simple and exact**: Partial. Evidence: Code - **Establish trustworthiness of each composition of elements**: Unverified. No code evidence yet - **Deliver critical capability through varied structure where it pays**: Unverified. No code evidence yet - **Make an element trustworthy with minimal dependence on others**: Unverified. No code evidence yet - **Manage complexity by decomposing and composing in a structured way**: Unverified. No code evidence yet #### NIST SP 800-218 Secure Software Development Framework (Tier A, 9 obligations) Implemented: 5, Partial: 3, Unverified: 1 - **Deploy and operate a secure development toolchain**: Partial. Evidence: Code - **Acquire and verify well-secured third-party components**: Implemented. Evidence: Gate - **Review and analyze code against secure coding standards**: Implemented. Evidence: Gate - **Test executable code and triage findings**: Implemented. Evidence: Gate - **Ship secure-by-default settings**: Partial. Evidence: Code - **Protect stored code from unauthorized access and tampering**: Partial. Evidence: Code - **Archive releases with integrity and provenance data**: Unverified. No code evidence yet - **Maintain a vulnerability disclosure and remediation policy**: Implemented. Evidence: Artifact - **Identify vulnerabilities in code and third-party components on an ongoing basis**: Implemented. Evidence: Artifact #### SOC 2 Trust Services Criteria (Tier B, 11 obligations) Implemented: 2, Partial: 8, Unverified: 1 Grounded via the public nist-800-53 crosswalk anchor; the proprietary standard's text is never stored. - **Maintain availability through backup and recovery**: Unverified. No code evidence yet - **Monitor the system for anomalies and security events**: Partial. Evidence: Code - **Protect system boundaries against external threats**: Partial. Evidence: Code - **Authorize, test, and control changes**: Partial. Evidence: Artifact - **Respond to and recover from security incidents**: Partial. Evidence: Artifact - **Logical access is restricted to authorized identities**: Implemented. Evidence: Assessed - **The system, its boundary and its data flows are described from the code**: Partial. Evidence: Artifact - **Encrypt data in transmission**: Partial. No code evidence yet - **Manage vendor and subprocessor risk**: Partial. Evidence: Code - **Detect and remediate vulnerabilities and misconfiguration**: Implemented. Evidence: Artifact - **Protect confidential information over its lifecycle**: Partial. Evidence: Artifact ### Germany (1 framework) #### BSI Cloud Computing Compliance Criteria Catalogue (Tier B, 6 obligations) Implemented: 5, Partial: 1 Grounded via the public nist-800-53 crosswalk anchor; the proprietary standard's text is never stored. - **Encrypt customer data in transit and at rest**: Partial. Evidence: Test - **Isolate tenants with database-enforced logical access control**: Implemented. Evidence: Assessed - **Operate a reachable security-incident intake channel**: Implemented. Evidence: Artifact - **Record security-relevant events in a tamper-protected audit trail**: Implemented. Evidence: Test - **Detect and remediate known vulnerabilities in dependencies**: Implemented. Evidence: Artifact - **Disclose subservice providers with per-entity transfer basis and enforce the register in CI**: Implemented. Evidence: Gate ### Denmark (1 framework) #### Danish Bookkeeping Act (Bogføringsloven) (Tier A, 2 obligations) Implemented: 2 - **Store accounting records so they cannot be altered or lost within the retention period**: Implemented. Evidence: Test - **Retain accounting records for at least five years after the financial year ends**: Implemented. Evidence: Test Equivalences between frameworks run through a 32-node crosswalk, so a control proven once counts for every standard that shares it. ## What the EU promise does not cover Everything below sits outside the EU promise today, or has providers beneath it that do. Each row says what it is, where it goes and what it keeps. ### Mistral AI SAS - **What it is**: Language-model generation (chat answers, planning, tool use, reading images, input moderation) and text embeddings for search. The only managed inference provider; there is no fallback outside the EU. Providers beneath it are outside the EEA or state no country: Microsoft Inc. (country not stated), Google LLC (country not stated), CoreWeave Inc. (country not stated), and Cloudflare Inc. (country not stated). - **Where it goes**: France - **What it keeps, and for how long**: unknown. We have no primary source. ### Supabase, Inc. - **What it is**: Primary datastore: Postgres (documents, chunks, embeddings, tenants), authentication, and default object storage. Incorporated outside the EEA, or owned from outside it. Providers beneath it are outside the EEA or state no country: Amazon Web Services, Inc (country not stated), Cloudflare, Inc (country not stated), Google, LLC (country not stated), Fly.io, Inc (country not stated), Upstash, Inc (country not stated), and Vercel, Inc (country not stated). - **Where it goes**: Ireland - **What it keeps, and for how long**: unknown. We have no primary source. ### Upstash, Inc. - **What it is**: Redis: API rate limiting, session revocation, embedding cache, and impossible-travel detection. Incorporated outside the EEA, or owned from outside it. Region not pinned to the EU. Providers beneath it are outside the EEA or state no country: Amazon Web Services (United States), Google (United States), and Cloudflare, Inc. (United States). - **Where it goes**: no pinned region - **What it keeps, and for how long**: unknown. We have no primary source. ### Cloudflare, Inc. - **What it is**: DNS for our domain. Incorporated outside the EEA, or owned from outside it. Region not pinned to the EU. Who sits beneath it is not established for the product we use. - **Where it goes**: no pinned region - **What it keeps, and for how long**: unknown. We have no primary source. ### Functional Software, Inc. - **What it is**: Application error and performance monitoring. Incorporated outside the EEA, or owned from outside it. Region not pinned to the EU. Providers beneath it are outside the EEA or state no country: Amazon Web Services, Inc. (country not stated), Cloudflare, Inc. (country not stated), and Google LLC (country not stated). - **Where it goes**: Germany and United States - **What it keeps, and for how long**: 90-day rolling event retention (vendor-documented: 90 days on paid plans, 30 on free; mirrored in docs/compliance/data-retention-policy.md); event.user.email attaches for consent-granted users and has no erasure hook, so it outlives an erasure request until the 90-day roll-off. Named residual in the erasure-propagation register; closes at the 0F Bugsink cutover. Source read July 22, 2026. ### Sendinblue SAS (Brevo) - **What it is**: Transactional email (notifications, account mail). Providers beneath it are outside the EEA or state no country: Cloudflare (United States). - **Where it goes**: France - **What it keeps, and for how long**: Transactional EVENT logs (recipient, subject, delivery events) are stored indefinitely by default until an account retention rule is set (1 month to 5 years); email BODIES are not stored by default ("Never store previews" is the default). Provisioning checklist sets the 1-3 month rule in the same session as the key. Source read July 22, 2026. ### Vercel Inc. - **What it is**: Application hosting and scheduled jobs (former deployment target). Incorporated outside the EEA, or owned from outside it. Region not pinned to the EU. Providers beneath it are outside the EEA or state no country: Amazon Web Services, Inc. (United States), Google LLC (United States), Microsoft Corporation (United States), Upstash, Inc. (United States), Neon (United States), and Redis Labs, Inc. (United States). - **Where it goes**: no pinned region - **What it keeps, and for how long**: unknown. We have no primary source. ### Web search queries - **What it is**: The text of a query, sent by our search service to the engines it asks. - **Where it goes**: Engines outside our control. - **What it keeps, and for how long**: unknown. We have no primary source. ## Claims the register refuses *What we decline to say* Every marketing claim we could make is declared against a predicate over the sub-processor register and this control board, and evaluated on every commit. The sentences in this section are the ones that evaluation refuses today, each beside the fact that refutes it, so you can see what we do not say and why. ### We do not say: "Nordvec conforms to the harmonised standard EN 301 549 and is therefore presumed to meet the European Accessibility Act." Would be load-bearing under Directive (EU) 2019/882, Art. 15 **Refuted today by** - No version of EN 301 549 is cited in the Official Journal under Directive (EU) 2019/882, so none confers a presumption of conformity under it ### We do not say: "Nordvec meets every EU AI Act obligation." Would be load-bearing under Regulation (EU) 2024/1689 **Refuted today by** - 15 of 16 distilled EU Artificial Intelligence Act obligations are not yet implemented ### We do not say: "No vendor that processes customer content, and no parent of one, is incorporated outside the EEA." Would be load-bearing under GDPR Chapter V **Refuted today by** - Supabase, Inc., incorporated in United States - Upstash, Inc., incorporated in United States - Cloudflare, Inc., incorporated in United States - Functional Software, Inc., incorporated in United States - Vercel Inc., incorporated in United States **What we commit to instead** Elsewhere in the stack, providers whose parent company sits outside the European Economic Area are being replaced, and we will not launch while any of them still processes customer content. Our sub-processor register names each one, what replaces it, and where that work has got to. Verdicts as of October 5, 2026, computed by the same evaluator that gates every commit. ## Ask us Security questionnaires and evidence requests go to one address. Send your questionnaire there and we answer it by email. [trust@nordvec.com](mailto:trust@nordvec.com) [Data processing agreement](/dpa) DPA terms, SLA and invoicing [Talk to us](/request-access) This page is not legal advice.