Trust Center
Aeqora's security, privacy, data processing, and self-compliance documentation. Legal copy reviewed: 8 October 2026. Deployment and contractual evidence requires separate verification.
Data residency
Supplier dependent
Privacy
Controls and policy
DPA
Request current terms
Access
Tenant controls
EU AI Act Self-Compliance
Aeqora as a Deployer
Aeqora uses Anthropic or configured OpenRouter providers for document drafting — a General Purpose AI model. Our use is classified as Limited Risk (Article 50 transparency duties require separate assessment: all AI-generated content carries a visible AI disclaimer and is not presented as human-authored). We do not deploy high-risk AI systems as defined by Annex III.
Aeqora as a Provider
Aeqora's classification and document generation capabilities do not fall under Annex III high-risk categories. The platform does not make consequential decisions about natural persons — it assists compliance professionals in managing their own compliance obligations. This preliminary assessment must be documented and reviewed as the EU AI Act's guidance evolves.
This is Aeqora's own preliminary self-assessment and does not constitute a determination by a national competent authority. Aeqora does not provide legal advice.
Data Processing Agreement
Aeqora acts as a data processor for personal data you input into the platform in the course of managing your EU AI Act compliance. We process data under GDPR Article 28. Request the current Article 28 processing terms before sharing personal data. The requirement for processor terms depends on processing, not the subscription tier.
Subprocessors
Aeqora uses the following sub-processors to deliver its services. Supplier information links below do not establish that agreements have been signed or transfer safeguards verified for this deployment.
| Subprocessor | Purpose | Region | Supplier information |
|---|---|---|---|
| Supabase | Database, authentication, storage | Deployment dependent | Supplier terms |
| Anthropic | AI document generation (Claude API) | Contract and configuration dependent | Supplier terms |
| Stripe | Payment processing and billing | United States / EU | Supplier terms |
| Vercel | Application hosting and CDN | Deployment dependent | Supplier terms |
| Resend | Transactional email | Contract and configuration dependent | Supplier terms |
| OpenRouter | Optional AI routing and model providers | Provider dependent | Supplier terms |
| Sentry | Optional error monitoring | Deployment dependent | Supplier terms |
| PostHog | Product analytics (EU Cloud) | EU (Frankfurt) | Supplier terms |
Data Retention
| Data type | Retention period | Basis |
|---|---|---|
| Account and customer compliance data | Customer agreement and erasure process | Purpose and applicable legal duties |
| Audit and classification records | Requires a documented retention schedule | Accountability; append-only storage does not mean indefinite lawful retention |
| Deployer logs under customer control | At least six months unless other applicable law provides otherwise | Article 26(6), where applicable |
| Optional analytics | Supplier configuration; request current schedule | Consent |
| Billing records | Applicable statutory record-keeping period | Legal obligation |
Security
Encryption in transit
TLS 1.2+ for all connections. HSTS enabled.
Encryption at rest
AES-256 encryption via Supabase (AWS RDS) and Supabase Storage.
Authentication
Supabase Auth with email + password. PKCE flow. Session tokens expire and refresh automatically.
Authorization
Row Level Security (RLS) enforced at the database layer via JWT org_id claims. Every table scoped to the organization.
Multi-tenancy
Strict org_id isolation. No cross-tenant data access possible at the database policy level.
Admin access
Service role key stored server-side only. Never exposed to browser. Admin operations scoped to specific server actions.
Webhook security
Stripe webhook signature verified before processing. Raw body preserved for HMAC verification.
Secret management
All secrets stored in environment variables. Never committed to git. Vercel encrypted environment variables.
Product Liability Notice
National transposition deadline: 9 December 2026 (Directive 2024/2853)
Aeqora is software that assists with compliance management. It does not constitute legal advice. Aeqora's outputs require human review and approval before use. Legal references have a dated review; customers should reassess older records when law or use cases change. If Aeqora's platform undergoes substantial modifications after December 9, 2026, we will update our PLD risk assessment and notify affected customers.