Sovereign evidence for every scored asset.
EU-sovereign infrastructure, tenant isolation, and auditable TAS outputs for leasing-risk, board reporting, and Battery Passport readiness.
EU-sovereign by default
Compute runs on Azure Sweden Central, database stays in the EU, and TAS scoring remains deterministic. The point is not generic “AI compliance”, but evidence that stays under Finnish and EU jurisdiction.
Board-ready audit evidence
Arctura packages TAS, battery-health, and reporting outputs into a traceable evidence layer. That gives operators, risk owners, and boards something concrete to review instead of a black-box dashboard claim.
Battery Passport readiness
Battery-health snapshots, score versions, confidence fields, and limitations are documented so the same surface can support residual value work today and Battery Passport workflows next.
Alikäsittelijät (Sub-processors)
| Palvelu | Käyttötarkoitus | Sijainti |
|---|---|---|
| Microsoft Azure | Cloud compute | 🇸🇪 Sweden Central (EU) |
| Supabase | Database, Auth | 🇮🇪 EU (Irlanti) |
| Stripe | Maksut | 🇮🇪 EU (Irlanti) |
| Mistral | EU-mode AI processing (EU-only posture, contractable) | 🇫🇷 EU |
| Resend | Sähköposti (transactional) | 🇺🇸 USA (DPF) |
| Google AI (Gemini) | Fleet analytics (opt-in, no PII) | 🇺🇸 USA (DPF/SCC) |
| Anthropic (Claude) | Fleet analytics (opt-in, no PII) | 🇺🇸 USA (DPF/SCC) |
| x.ai (Grok) | Fleet analytics (opt-in, no PII) | 🇺🇸 USA (SCC) |
| OpenRouter | Multi-model gateway (opt-in, no PII) | 🇺🇸 USA (SCC) |
| Firecrawl | Web scraping (public data only) | 🇺🇸 USA (SCC) |
| DuckDuckGo | Public search API | 🇺🇸 USA |
EU-only AI -käsittely (sopimuksellinen): Enterprise-asiakkaat voivat sopia EU-only AI-moodista, jossa AI-käsittely rajataan EU-pohjaisiin palveluihin (esim. Azure SE, Supabase IE, Mistral FR). Sopimuksellinen sitoumus, ei tuotteen kytkin.
Breach notification: Käsittelijänä Arctura ilmoittaa rekisterinpitäjälle tietoturvaloukkauksesta ilman aiheetonta viivytystä, viimeistään 24 tunnin kuluessa havaitsemisesta — tukeakseen rekisterinpitäjän GDPR Art. 33 -mukaista 72 tunnin ilmoitusvelvollisuutta valvontaviranomaiselle.
Täydellinen DPA saatavilla pyynnöstä (/legal/dpa).
Control Surface
- Tenant isolation (RLS + tenant validation)
- Audit trail (versioned evidence outputs)
- Auth gates (JWT + API key)
- Application-level WAF + IP-based rate limiting
- Restricted CORS + service boundaries
- Runtime hardening (runAsNonRoot, drop ALL)
- Semgrep SAST + Trivy CI
- Documented DPA and sub-processor list
- No ISO 27001 / SOC 2 certifications held — Security & Integration Proof Pack available to CISO/DPO on request
Dokumentaatio & Lupa-asiat
DPA (Data Processing Agreement)
GDPR Art. 28 -mukainen sopimus.
Alikäsittelijät (Sub-processors)
Ajantasainen lista kolmansien osapuolien palveluista.
Tietosuojailmoitus
Rekisteröidyn oikeudet ja tietojen käyttö.
Evidence pack
Control narrative for operators, risk owners, and board-level review.
Need the full Security & Integration Proof Pack?
Architecture overview, data residency confirmation, WAF/RLS details, and a Security and Integration Proof Pack — delivered to your CISO or DPO.
Request Proof Pack →