Security and compliance

AM8 Trust & Compliance

AM8 runs the same audit it sells, on itself, continuously, and hands the results to any customer or auditor who asks.

Frameworks & Compliance Posture

The frameworks AM8 measures itself against. AM8 holds no third-party certifications yet.

GDPR

EU data protection: how we process data

EU AI Act

Regulation 2024/1689: self-assessed and monitored continuously

Jurisdictions covered

Every obligation, deadline and document for each jurisdiction we cover, kept current by named legal experts.

COVERED

European Union

EU AI Act (post-Omnibus dates) · GDPR touchpoints

COVERED

United Arab Emirates

PDPL · DIFC Regulation 10 · UAE AI Charter

Cookie Compliance

GDPR Art. 7 + ePrivacy

Consent mechanismFirst-party consent banner (no third-party consent-management platform).

Third-party scriptsOne: Vercel Web Analytics, loaded only if you consent to analytics. It is cookieless, served from this domain rather than a tracker origin, and never loaded at all if you refuse. No advertising, marketing or session-replay scripts of any kind.

Consent decisions recordedYes, every decision is logged with its evidence

Scan passed · 2026-09-10

Automated scan of https://am8-ai-governance.tech on 2026-09-10: nothing is stored in your browser before you choose, refusing leaves only the strictly necessary items named in the Cookie Policy, and analytics loads only after you accept.

Continuous Control Monitoring

Last measured 19 Oct 2026

AM8 monitors its own AI systems with the same continuous control monitoring it provides to customers, re-testing every applicable control on a regular schedule.

Controls monitored

Frameworks

EU AI Act · GDPR · UAE (PDPL / DIFC / AI Charter)

Detailed control-by-control results are available to customers, prospects and auditors on request under NDA. security@am8-ai-governance.tech

Evidence Integrity

Verifiable without AM8

Every evidence pack AM8 exports is signed with this key. Anyone holding a pack can confirm, offline and without contacting AM8, that it is the pack we produced and that nothing in it has changed since. A signature proves the pack is unaltered; it does not make its contents true.

Applies to packs exported from August 2026 onward. Earlier exports carry a content hash only and cannot be verified independently.

To check a pack, compare this key against the one inside it, then run the verifier.

Signature: Ed25519
Key ID: 9d3787bd05c60bea29772f1ccd90fef6
Public key (spki-der-base64): MCowBQYDK2VwAyEANNpyl8wJbIrEQeyV7eyS0J7hGNARvvZTYAXJSWSF10E=
Verifier: https://app.am8-ai-governance.tech/verify-audit-pack.mjs (runs offline, no dependencies)

Sub-Processor DPAs

GDPR Art. 28

The data processing agreement status of every provider that handles customer data, including any agreement still pending. No customer tenant is onboarded onto a sub-processor whose agreement is not yet in force.

Provider	Purpose	Data region	DPA status
Mistral AI	Independent verification of generated compliance documents	EU	Signed
Anthropic	AI processing (Claude): document generation, screening, the ARIA advisor, intake assistance, reports and digests, and AI-usage commentary	US (Standard Contractual Clauses)	Signed
Supabase	Database, authentication and file storage	EU (Frankfurt)	Signed
Vercel	Frontend hosting, content delivery and cookieless page analytics loaded only with consent	EU / US	Pending
Resend	Transactional email delivery	US (Standard Contractual Clauses)	Signed
Stripe	Payments and billing	EU (Ireland)	Signed
Sentry	Error monitoring, with personal data scrubbed before it is sent	US entity, EU data region	Signed
Railway	Backend hosting (API and background workers)	EU (Amsterdam)	Signed

View full sub-processor list

Security Controls

Data residency

Customer data is stored in the EU (Supabase, Frankfurt). AI requests go to Anthropic, a US provider, under Standard Contractual Clauses, through its global service, where inference may run in any geography Anthropic makes available; the vendor does not train on API data; no EU-region processing is currently available for this model. Independent verification of generated documents runs separately on Mistral AI, in the EU.

Encryption at rest

AES-256 (Supabase managed)

Encryption in transit

TLS 1.3 enforced

Authentication

Token-based authentication with per-customer access control enforced on every record

Backups

Encrypted backups held in two separate locations, with a restore tested on 26 August 2026. Recovery point is the age of the last backup; no point-in-time recovery

Audit logging

Records of every sensitive action, every control test and every piece of collected evidence, which the application cannot edit or delete. Corrections supersede; history is never rewritten through the application

PII scrubbing

Personal data is removed from error reports before they leave our systems

Access control

Role-based access for owners, admins and members

AI System Transparency

EU AI Act Article 13 + Article 50 disclosure

Claude (Anthropic)

limited risk

Used for

Compliance document generation
Weekly and monthly executive report generation
UAE Charter alignment assessment generation
Conversational compliance guidance in ARIA, the in-product advisor
Commentary in cost and value reports

Safeguards

All AI-generated compliance documents carry a DRAFT watermark until reviewed by a qualified human
No AI output is submitted to regulators without human sign-off
AI output is validated before it is stored, and anything malformed is rejected
Where independent checking is in force, every generated document is checked before review; a document that was not checked is labelled as such, never presented as verified

Claude (Anthropic) for Article 5 screening

limited risk

Used for

EU AI Act Article 5 prohibited practice screening

Safeguards

No AI output is submitted to regulators without human sign-off
AI output is validated before it is stored, and anything malformed is rejected

Article 50 disclosure: Content generated by Claude (Anthropic) is AI-assisted. ARIA, the in-product advisor, identifies itself as an AI system on every screen it appears on, before a person can send it anything. All AI-generated compliance documents are clearly marked as DRAFT until reviewed by a qualified compliance professional. AM8 does not present AI output as certified legal advice.

Establishment & Supervisory Authority

GDPR Article 3 · EU-established

AM8 SASU is established in France, within the EU. As an EU-established controller, AM8 is not required to appoint an Article 27 EU representative. EU data subjects may lodge a complaint with their local supervisory authority or with the French CNIL.

Data protection: privacy@am8-ai-governance.tech

Lead authority: CNIL (Commission Nationale de l'Informatique et des Libertés) · cnil.fr

UK Data Subjects

UK GDPR

If you are in the United Kingdom, you may lodge a complaint with the UK Information Commissioner's Office (ICO).

Contact: privacy@am8-ai-governance.tech

ICO · ico.org.uk

Documents & Security Contact

Security Overview (one-pager)

For enterprise due diligence · request by email

Data Processing Agreement (DPA)

GDPR Article 28

GDPR Art. 13/14

Report a vulnerability: we welcome responsible disclosure. Email our security team at security@am8-ai-governance.tech and we will acknowledge your report within two business days.

For data protection enquiries contact privacy@am8-ai-governance.tech. AM8 is a product of AM8 SASU, registered in France.