AIA Studio
ENFR
Request a demoSign in

Compliance, prepared by the platform.

The platform prepares, a person decides. It keeps the registers, counts the deadlines and fills in the declarations; a person qualifies an incident, approves each document and sends it, since the portals of the CNIL and of ENISA take no automatic submission.

GDPR — Regulation (EU) 2016/679

  1. 01

    Art. 5 and 25 — Principles, protection by design

    Each application declares its personal data, why it keeps it and for how long; the platform derives everything else from it.

  2. 02

    Art. 6 and 7 — Lawful basis

    Each purpose is declared with its lawful basis.

  3. 03

    Art. 9 — Sensitive data

    Health data is refused; the user is warned not to give sensitive data to the agents or to the AI functions.

  4. 04

    Art. 12 to 14 — Information

    The privacy notice of each application is written by the platform and updated at every change.

  5. 05

    Art. 15 to 22 — The rights of the people

    A person exports their data (portability) and has it erased; each request is recorded and followed within one month, which may be extended by two further months (art. 12(3)).

  6. 06

    Art. 5(1)(e) — Retention

    When their time is up, the data is erased or anonymised by a scheduled task, which keeps a record of what it did.

  7. 07

    Art. 28 — Processors

    The data processing agreement is prepared, with its annexes filled in for each client; the sub-processors are listed on a public page and their changes announced.

  8. 08

    Art. 30 — Records of processing

    Written by the platform and kept up to date at every change of the application.

  9. 09

    Art. 32 — Security

    In transit: every connection goes through the platform's entry point, in HTTPS, on a Let's Encrypt certificate for each address; browsers are held to HTTPS for a year (HSTS); the applications listen only on their own server, behind this entry point, which accepts connections only from the authorised countries. At rest: passwords and access tokens are kept only as a hash, never in clear; the applications' secrets (the keys and passwords of their services) are encrypted. The access rights of each application are tested by penetration tests at every delivery, and the security annex is written from the facts.

  10. 10

    Art. 33 and 34 — Data breaches

    An incident opens a file, starts the 72-hour clock and prepares the notification to the CNIL.

  11. 11

    Art. 35 — Impact assessment

    A first screening and a draft assessment are prepared for the applications that need one.

Trackers — ePrivacy Directive (art. 5(3)) and French Data Protection Act (art. 82)

  1. Consent first

    Nothing is stored in or read from a visitor's browser without their agreement, apart from what is strictly necessary; the proof of their choice is kept. Fonts are installed with the application, never loaded from a third-party service.

Data Act — Regulation (EU) 2023/2854, chapter VI: switching provider

  1. 01

    Art. 23 and 25 — Leaving with everything

    The client leaves with everything the platform and our hosting keep, their data and their application's code with its history, through a dated exit: notice, transition, retrieval, then full erasure attested by a certificate. A production the client runs itself is not with us: it stays in the client's hands.

  2. 02

    Art. 26 — Formats

    An online register of the data formats and structures.

  3. 03

    Art. 28 — Jurisdiction

    A page on the jurisdiction the hosting falls under.

  4. 04

    Art. 30(5) — Open export

    The export is in a structured, commonly used and machine-readable format.

AI Act — Regulation (EU) 2024/1689

  1. 01

    Art. 50(1) — Transparency

    Each person is told that they are dealing with an AI, in the studio and in the applications.

  2. 02

    High risk (annex III)

    For an application that evaluates people, in recruitment for example: each use is logged and the log kept at least six months (art. 12, 19 and 26); the documentation and the GDPR data protection impact assessment (art. 35) are prepared; the deadlines of art. 73 are counted in the incident file.

Cyber Resilience Act — Regulation (EU) 2024/2847

  1. 01

    Component list

    The list of components (SBOM, in the CycloneDX format) is written at every build and handed over with the code.

  2. 02

    Vulnerabilities

    A disclosure policy, a contact address, and the dependencies checked.

  3. 03

    Art. 14 — Reporting

    An actively exploited vulnerability, or a severe incident having an impact on the security of the product, opens a file with the 24-hour, 72-hour and final-report deadlines, and prepares each notification, to be sent at the same time to the CSIRT designated as coordinator and to ENISA, through the single reporting platform.

  4. 04

    Technical documentation

    The technical documentation and the EU declaration of conformity are prepared for each version, to be approved.

What the platform does by itself

  • the records of processing
  • the privacy notice
  • the list of sub-processors
  • the purge of data when its time is up
  • the anonymised test copy
  • the log of AI uses
  • the component list
  • incident files with their deadlines and pre-filled declarations
  • the exit export
  • erasure with its certificate