Trust & compliance
Our compliance statement.
Transparency is part of sovereignty. This page sets out exactly where we stand, including what is still in progress.
Last updated: September 2026
Certification and alignment status
ISO/IEC 27001:2022
Certification in progress
EUTS is not currently certified under ISO/IEC 27001. Our information security practices are designed in alignment with the requirements of the standard and its Annex A controls, and we are preparing for a certification audit by an accredited certification body.
SOC 2 (AICPA Trust Services Criteria)
Examination in preparation
EUTS has not completed a SOC 2 examination and does not hold a SOC 2 report. Our controls are designed with reference to the Trust Services Criteria for security, availability and confidentiality, and we are preparing for an examination by an independent auditor.
GDPR (Regulation (EU) 2016/679)
Applied
We process personal data in accordance with the GDPR. Where we process data on behalf of clients, we do so as a processor under a data processing agreement pursuant to Art. 28 GDPR, which is available on request.
EU AI Act (Regulation (EU) 2024/1689)
Controls aligned
We assess each AI use case against the Act's risk categories and support clients in meeting the obligations that apply to them as deployers, including transparency, record-keeping and human oversight.
Important notice
References on this website to ISO/IEC 27001, SOC 2 or other frameworks describe the design of our controls and our ongoing certification efforts. They do not represent that EUTS, or any EUTS solution, is currently certified, attested or audited under those frameworks. No certificate or attestation report has been issued to date.
Statements of alignment reflect our own assessment and have not been verified by an independent third party. Timelines for certification depend on external audit bodies and are not guaranteed. We will update this page when the status changes.
If you need specific assurances for procurement, a vendor assessment or an audit, please contact us. We are glad to share our security documentation under a non-disclosure agreement.
How we protect data today
Data residency
Client data is processed in the EU or on client premises, as agreed in writing for each engagement.
Encryption
Data is encrypted in transit and at rest using current, industry-standard protocols.
Access control
Role-based access, least privilege, multi-factor authentication and support for single sign-on.
Audit logging
Security-relevant and administrative actions are recorded so they can be reviewed.
No training on client data
Client data is never used to train models for other clients or for third parties.
Minimal subprocessors
We keep subprocessors to a minimum and disclose them in our data processing agreement.
Incident response
Documented procedures to detect, contain and report security incidents, including GDPR notification timelines.
Continuity
Backups, tested restores and documented recovery procedures for production systems.
Documentation available on request
- Data processing agreement (Art. 28 GDPR)
- Technical and organisational measures (TOMs)
- List of subprocessors
- Security overview (under NDA)
Questions about security or compliance?
Write to us and a member of our team will respond.