Just Smarter Eval●
Sign in Run an eval →
// Compliance

Compliance, line by line.

The detail behind the trust page. What's signed, what's available, what's documented. This page is what your DPO and security review will read.

// 01 · Frameworks & controls

What's in place today.

If it isn't on this page it isn't a JSE commitment. We don't list certifications we don't hold or paths we haven't started.

GDPR Article 28 DPA
Standard data-processor addendum, prepared at contracting.
● Available on request
Standard Contractual Clauses
EU 2021/914, Module 2, signed at contracting.
● Available on request
Per-eval audit artifact
An eval cell records the requested and resolved model, token counts, latencies, and — when scoring is enabled — the score record. Exportable as CSV / JSON / Markdown — usable as evidence for AI Act Art. 15 accuracy / robustness documentation.
● In place
Schrems II — Transfer Impact Assessment
Per-hosting-tier TIA prepared on first enterprise request.
● Available on request
EU Strict tier — model inference
Mistral models only (Paris, EU-owned vendor and datacenter). No US-owned vendor reaches EU Strict.
● In place
Data residency
Application database, eval logs, and EU Strict / EU Cloud model routing all on EU/EEA infrastructure.
● EU/EEA
Encryption (at rest / in transit)
Stored provider API keys and chat prompt previews are encrypted in the application with AES-256-GCM under HKDF-derived, per-purpose keys. Other stored data, including eval outputs, is held on encrypted infrastructure volumes rather than encrypted per column. TLS 1.3 in transit.
● In place
PII pseudonymization (Microsoft Presidio)
Detected PII is replaced with tokens before the prompt reaches the model, and restored in the response. Per-request receipt with applied sensitivity level. Pseudonymization is reversible by design, so pseudonymized data remains personal data under the GDPR. A detect-only mode is also available, which logs detected PII without modifying the prompt. The claim covers DETECTED PII only. Coverage depends on detection, which is best-effort — undetected PII reaches the model unmodified.
● In place
Right to erasure (GDPR Art. 17)
Self-service one-click delete; cascading database delete. Deletion removes the record from live systems. Copies can persist in infrastructure backups after deletion; the retention of those backups, and how they behave on a restore, are not described here.
● In place
Age gate (GDPR Art. 8)
Self-declared birth year enforced at registration (≥16).
● In place
// 02 · How routing works

Three tiers, hard-coded at the gateway.

Every request entering JSE is tagged with an active tier before it touches a model. The tier is set per-workspace (and overridable per-run by an admin). The gateway evaluates the model registry against the tier policy:

  • EU Strict — only EU-owned vendors hosted in EU-owned datacenters are eligible. Today: the Mistral family only (Paris). Amazon Nova does not qualify because AWS is US-owned, even though the datacenter is in Stockholm.
  • EU Cloud — EU-resident datacenters, vendor ownership not constrained. Today: Mistral + Claude (Bedrock Frankfurt) + Amazon Nova (Bedrock Stockholm) + Gemini (Vertex EU).
  • Unrestricted — global routing. Required only when the user explicitly opts in.

A request to a model outside the active tier returns 400 model_not_compliant with the policy ID that rejected it. Nothing leaves the gateway, nothing is logged downstream.

What we record

An eval run stores its prompt set, the models requested, and the compliance tier it was submitted under. A cell in that run — one prompt against one model — stores:

  • The model requested and the model the gateway resolved it to
  • The output text and its word count, or the error text if the cell failed
  • Token counts (input / output)
  • Latency — time to first byte and total time for the cell
  • The score record, when scoring is enabled: the scorer method, pass / fail status, and for LLM-judged rows the judge model and the judge's written rationale
  • Gateway metadata when the gateway reports it: finish reason, a derived flag for a response that completed with no usable content, parsed tool calls, and — on a failed cell — the gateway's block reason

Some things are worth stating as absences, because a reader may expect them: JSE does not compute a cryptographic fingerprint of an eval prompt, does not store which provider or datacenter served the inference, and does not store a cost in EUR against an eval run.

Eval and audit logs are retained for the lifetime of the user account; users can request export or deletion at any time per GDPR Art. 15 / Art. 17; deletion removes the record from live systems, and copies can persist in infrastructure backups after deletion. Default retention policy and longer compliance retention can be specified in the contractual DPA.

Data subject rights — automated

  • Art. 15 / Art. 20 — one-click JSON export of all user data (profile, balance, usage, conversations, eval runs, consent history).
  • Art. 16 — self-service profile edit.
  • Art. 17 — one-click account deletion; cascades across all linked data. Consent records are kept after account deletion, with personal fields scrubbed, as proof of the legal basis relied on while a claim remains possible under the Swedish statute of limitations. Their deletion is not currently automated on a schedule.
  • Art. 18 / Art. 21 — email support@justsmarter.ai; response SLA 30 days (extendable 60 per Art. 12(3)).
  • Art. 77 — right to lodge complaint with the Swedish IMY at imy.se/en.

Sub-processor changes

30-day notice before any new sub-processor is added. You can object; if we can't accommodate, contract terms allow termination without penalty.

Incidents

Material incident notification within 72 hours of detection, regardless of contractual tier. Status page and changelog reflect post-mortems publicly when customer data is involved.

Trust pack

Request the full Trust Pack (signed DPA template, SCCs, security white-paper) at support@justsmarter.ai. We answer within two business days.

Got a security review?

Send us your questionnaire. We answer in plain language, with evidence attached, within two business days.

support@justsmarter.ai Back to Trust