Compliance

Built for the EU AI Act
From day one

Compliance isn't a layer we added. It's the substrate every agent sits on. Sensitive data never touches an American cloud - enforced at the gateway, sealed in the ledger, verifiable on demand.

No credit card needed

EU AI Act high-risk ready SOC 2 Type II ISO 27001 certified
Three pillars

Compliance, by construction

Not a feature flag, not a checklist. Three engineering decisions that make the rest possible.

01

Sovereign infrastructure

Engineered in Copenhagen, hosted in Europe. Sensitive workloads never leave EU jurisdiction. Tier-3 data routes to a European GPU. Period.

02

Tier routing at the gateway

Every request classified by data sensitivity, routed to the right model in the right jurisdiction. Hard-enforced - not trusted to a policy document.

03

Append-only evidence ledger

Every agent action signed, sealed, retained for 3–7 years per DPA. Daily root hashes published. Article 14 export with one command.

Article 14 evidence

Every decision logged.
Provable to an auditor

Hash-chained, append-only, tamper-evident. Your DPO reads the same ledger your agents do.

23-04 14:03:47create_doc · @sofie · tier 2 · approved0x7f3a…e91c
23-04 14:03:12llm_call · mistral-large · 1243 tokens0xa9d2…4b17
23-04 14:02:58vault_read · volvo-q1-proposal0x3e11…8caf
23-04 14:02:02message_in · @sofie → @sofie-agent0x9b7c…2f45
23-04 14:01:38tier_route · t2 → mistral-large · EU0x18cd…b034
Data residency

Where your data lives

Three tiers. Three jurisdictions. Zero overlap with US hyperscalers for sensitive workloads.

Tier 1 · public-grade Marketing copy, blog drafts, public research. Cloud frontier model. Anthropic · DE
Tier 2 · client confidential Proposals, internal strategy, customer-named work. Mistral · FR
Tier 3 · regulated PII, payroll, health records, anything HIPAA/GDPR-special. Llama · DK GPU
The trust stack

Ten layers of work,
so you can ignore them

From the chat surface your team uses every morning down to the audited hardware in a Copenhagen rack - every layer is signed, sealed, and ours to operate. You focus on running the business; we handle the substrate.

01 Agents & chat surface SLACK · TEAMS
02 Identity & SSO SAML · OKTA · AZURE AD
03 Tier routing gateway APERTURE
04 LLM providers CLAUDE · GPT-5 · MISTRAL · LLAMA
05 Memory vault, three tiers PRIVATE · TEAM · COMPANY
06 Evidence ledger APPEND-ONLY · 3-7 YR
07 Encryption at rest & transit AES-256 · TLS 1.3
08 Network isolation PER-TENANT TAILNET
09 Sovereign hosting EUROPE · EU
10 Audited hardware SOC 2 · ISO 27001
Certifications

Built for trust

Audited, certified, contractual. Not "we take security seriously."

SOC 2 Type IIIn review — certificate Q4 2026
ISO 27001Certified Q4 2026
GDPR & DPAPer-tenant residency
EU AI ActHigh-risk ready

Talk to your DPO before
your competition does.