eudr.dev

Security and trust

What a buyer's vendor form asks, answered from what runs today.

Where data lives

One server in the AWS Stockholm region (eu-north-1), run by Vortx AI Private Limited. Satellite lookups go to emem.dev, the same company; the legal basis is at /legal/tia. Every other processor is listed at /legal/subprocessors, with 30 days' notice of a change.

How a statement can be checked

Each statement carries a signed receipt over its evidence. Anyone can check one at /verify without an account, or offline with the published key; the method is at /methodology.

Backups

Snapshots are taken hourly and kept on the same server. There is no off-site copy yet; until there is, the loss of the server loses data since the last copy made elsewhere.

Certification

eudr.dev holds no SOC 2 or ISO 27001 certification. The code is open for review at github.com/Vortx-AI/eudr.

Contracts

Data processing agreement: /legal/dpa. Service levels: /legal/sla. Acceptable use: /legal/aup. Privacy notice: /privacy.

Reporting a vulnerability

Through a private GitHub advisory, as security.txt says. Other questions: /support.