Skip to content
Decision-Evidence Operating System

Trust centre

If you cannot check our claims yourself, they are marketing.

This page exists so a diligence reader can disagree with us using our own material. It carries the regulation mapping, the isolation model, and what happens when things fail.

How the record maps to each regime

Mapping to an obligation is a different claim from having been assessed against it. We are making the first claim, not the second.

EU AI Act, Article 12

Automatic recording of events over the system’s lifetime.

The governed decision record is that log — not a copy of it, not a report derived from it.

EU AI Act, Article 14

Human oversight must be substantive, not nominal.

A named chair rules at a durable waitpoint, with reasons captured as a required field.

EU AI Act, Annex III

Insurance risk assessment and pricing are high-risk under Regulation (EU) 2024/1689.

Obligations apply from 2 December 2027, deferred from 2 August 2026 by Regulation (EU) 2026/1744.

CJEU C-203/22 (SCHUFA line)

The reasoning behind an automated decision must be explicable to the data subject.

The record compiles a per-subject rendering from the same thread the regulator reads.

GDPR Articles 9 and 22

Special-category data and automated decisions.

Psychometric and emotion inference never reach a risk decision — enforced in the platform.

Solvency II Article 124

Internal-model validation.

Reproducible seeded runs and logged expert judgement compile into the dossier.

DORA

Operational resilience for financial entities.

Change to a rule, threshold, persona or model version is itself a gated, certificate-bearing record.

S.I. 80/2025 & S.I. 81/2025

The Consumer Protection Code 2025 — a refusal must be communicated effectively and in plain language. Successor to the 2012 Code, revoked 23 March 2026.

Every refusal code on this site states what is missing and what would fix it. FSPO 2024-0061 is the cost of not doing that: an insurer’s declinature was found unreasonable and unjust because it “did not offer any detail regarding what was missing or what the Complainant had failed to supply, or what was required.”

Isolation — three axes, or a refusal

Every read, write and dispatch is scoped on your organisation, the individual owner, and optionally the business unit. Anything personal — a mailbox, a harvest, a derived graph — stays private even inside one organisation. The predicate lives in the shared query layer that every repository inherits, not in something each route remembers to append. Identity is resolved from the authenticated request and nowhere else: no environment variable may translate it, and no tool or job may accept it as an argument.

When a surface cannot resolve all three axes, it does not guess and it does not fall back to a wider read. It refuses, with a machine code you can quote at us:

That screen is on this page deliberately. Where the product fails closed we would rather show you the failure than describe the success.

Where your data lives, and whose keys run the AI

Residency

In our own European datacentre. Not a hyperscaler region, not a US-owned control plane. Evidence you cannot remove is evidence you do not own, so export is complete and in an open format, hashes included, so it stays checkable after it leaves us.

AI credentials

Your organisation’s own provider pool, your own billing. We hold no shared key behind your tenant. An organisation with no keys configured cannot serve AI at all — an honest empty state rather than a silent fallback to ours.

Analytics on this site is first-party and disclosed on the privacy page. A page arguing for evidence integrity may not ship third-party trackers that contradict its own privacy policy.

Send me the paper

Four working papers. A person sends the one you pick — no download wall, and no meeting is booked.

Work out what this costs