Trust center
NovaCopilot runs in production and is continuously indexed by AI engines, search engines and hyperscaler crawlers. No customer data is processed. This page describes how the platform is built and the actual status of each control, no certifications are claimed that we do not hold.
The table is designed to be pasted directly into a vendor assessment. Status is updated continuously and we always distinguish implemented from planned.
| Requirement | How we meet it | Status |
|---|---|---|
| GDPR: processing of personal data | The copilot does not receive, process or store customer data. No personal data passes through the platform in the default configuration. | Implemented |
| GDPR: data processing agreement (DPA) | A DPA template and a list of sub-processors are provided during evaluation. | In progress |
| EU AI Act: transparency and risk class | Deterministic modules, hard-coded escalation rules and logging of every response. Classification documentation is produced per use case. | In progress |
| ISO/IEC 27001 | Controls are designed in line with the framework. No certification has been issued. | Planned |
| DORA: ICT third-party risk | Documentation for vendor assessment, exit plan and incident procedure is prepared ahead of contracting. | Planned |
| Data storage within the EU | Operation and logs in the EU region. | Implemented |
| Independent penetration test | Carried out ahead of the first production deployment with a customer. | Planned |
| Traceability / audit trail | Every intent, module, response and escalation is logged with a timestamp and module version. | Implemented |
References to GDPR, the EU AI Act, ISO/IEC 27001 and DORA describe how the product is built to support your obligations. They are not independent certifications or audit opinions.
Technical fact sheet
The claims below can be verified in the code during a technical review. We describe the mechanism, not just the promise.
We respond to vendor questionnaires, security questionnaires and DPA reviews within five business days.
Security & compliance
A summary of how the platform is constructed. Evidence per requirement is available in the Trust Center.
The copilot is built as zero-data: no personal data is received, processed or stored in the standard configuration. There is therefore no customer profile to leak or delete afterwards. A DPA template and a list of subprocessors are provided during evaluation.
Role-based access with least privilege, MFA for all administrative login, separated environments for development, testing and production, and key management in Azure Key Vault. No shared accounts and no standing production access.
Every interaction is logged with timestamp, module used, rule matched, escalation decision and cost entry, with no content that identifies a person. The logs are designed to be usable as audit evidence.
Operations and storage take place within the EU region. Operational logs and telemetry are stored for 90 days and then deleted. No conversation history linked to an identified person is retained between sessions.
The backend runs in Microsoft Azure within the EU region, with Azure's platform controls for network isolation, encryption at rest and in transit, and region selection. Microsoft is listed as a subprocessor.
The copilot never answers legal questions, confidentiality matters or subject access requests itself. Such questions hit a hard-coded escalation rule and are handed over to a human on your side, or to us where the platform is concerned.
Escalation chain for legal and confidentiality matters
A question about GDPR, deletion, subject access, contracts, complaints or contact with authorities.
No generated legal assessment. A deterministic standard answer is given.
The case is routed to your designated function or to a data protection contact.
The escalation is recorded in the audit trail with timestamp and reason.
Boundary
This page is maintained by Valkiv Ventures AB and describes activated controls and design choices, it is not a certification or an audit opinion. Security or privacy questions: info@valkiv.se.
NovaCopilotLegal assistant