/ trust / data & compliance

Your data, on your terms.

What European and UK buyers ask for before a contract. Answered here so procurement does not have to wait.

Working with EU & UK clients

We are established in Pakistan, which has no EU adequacy decision. Transfers of personal data to us are therefore made on Standard Contractual Clauses, attached to a processor agreement. We sign both, and we support the transfer impact assessment your side has to run.

processor agreement: GDPR Art. 28 DPA — we sign yours, or provide ours.
transfer mechanism: EU Standard Contractual Clauses (module 2, controller→processor). UK: IDTA or the UK Addendum.
transfer impact assessment: We answer the vendor questionnaire and document our sub-processors, access controls and government-access exposure.
data residency: On request the whole system runs in EU-hosted infrastructure. Your keys, your account, your region.
subject requests: Access, deletion and export requests reaching us are forwarded to you and actioned on your instruction.

Standing rules on every build

no model training: Your data never trains a model — ours or a vendor’s. Provider training is switched off in the account configuration.
human approval gates: Anything that costs money, messages a customer or writes to a record waits for a human. You decide what may run unattended.
logged and reversible: Every tool call is recorded with inputs, reasoning and result. Wrong turns are visible and can be rolled back.
least access: Agents get scoped credentials for the systems they need, nothing wider. Access is revoked at handover.
handover: Code, prompts, evals and infrastructure are yours from the first commit — in your repository, on your keys.
no certification claims: We are not ISO 27001 or SOC 2 certified and do not claim to be. What is described here is what we do; ask and we will evidence it.

Sub-processors

The list below is the pool we build from. The exact set for your project is fixed in the DPA before work starts — and any of them can be swapped for an EU-hosted or self-hosted alternative if your policy requires it.

processorroleregion

Anthropic (Claude) model inference US · EU routing available

OpenAI model inference US · EU data residency available

Google (Gemini) model inference US / EU

Supabase application database, auth EU regions available

Vercel hosting, edge delivery EU regions available

Hostinger hosting for client sites EU (Lithuania / Netherlands)

Stripe payments, where in scope EU entity available

Meta (WhatsApp Business API) messaging, where in scope per Meta terms

Hours that actually overlap

Lahore runs UTC+5. That is four to five hours of live overlap with the European working day — same-day answers, not next-day ones. Written handover covers the rest.

Send it to procurement.

+92 310 6908171