Compliance and security.
The rules of your sector, and what the system records. With hosting in the EU, a log that cannot be altered, and a person who decides.
No obligation · six questions · reply within one to two working days
Security.
What is in place, in writing and not just in conversation.
Hosting and access
- Database and hosting in the EU, encrypted
- EU hosting with ISO 27001-certified partners
- Users, roles and permissions, with your own Microsoft sign-in and MFA
Log and recovery
- A log of every step that cannot be altered
- Back-up every hour, restore tested every quarter
- Paper fallback: always an up-to-date PDF of all active records
- We report a data breach within 24 hours
Support
- Monitoring that alerts us before you notice anything
- Security updates as soon as they are released
- Target availability 99.5% per month, with response times in the SLA
- A report every quarter: availability, incidents and the result of the back-up test
AI and data.
The system proposes, a person decides. Your data does not train models.
Data
- Only models covered by a data processing agreement; your data does not train models
- Data stays in the EU
- Access by role, as in the rest of the system
Oversight
- For each application, we record which AI Act risk class it falls under, and how human oversight works
- Every result comes with its source. If the system is unsure, it goes to a person
- A log of every proposal and every decision
What we do not do
- Systems that decide on their own, without a person
- A model that quietly learns from your data. Improvements go through the test set and instructions, visibly and with your approval
Compliance you can prove.
For each sector, what the inspector asks for and what the system records.
| Rule | The inspector asks | The system records |
|---|---|---|
| BRZODutch Major Accident Hazards Decree | Proof that safety management works | Permits, MoC and incidents |
| CyberbeveiligingswetDutch NIS2 Act | Duty of care, report within 24 and 72 hours | Access and changes per user |
| EU ETS and CBAM | Emissions per installation and import | Measurements with source and date |
| NEN 3140, VCA and GWO | Who is qualified for which work | Qualification per person and task |
| For every sector | ||
| GDPR | Who processes personal data, and where | Data processing agreement, EU hosting with ISO 27001-certified partners |
| AI Act | Human oversight of AI | Every proposal with who approved it |
Ownership.
Built by NUL-G, owned by you.
Yours
- Source code, data and documentation are yours
- The rights transfer per phase, once that phase is paid. No licence
- After every phase, the code in your own repository, with documentation
Free to leave
- You may maintain it yourselves or have another team carry on
- When you leave: code, data export and documentation, plus a handover meeting with the new team
- Mainstream, open technology that any experienced team can take over
Questions.
About security, data, contract and support.
What about security and NIS2?
Roles and permissions, a log that cannot be altered, hourly back-ups and a restore tested every quarter. We report a data breach within 24 hours.
Where is it hosted?
In the EU, encrypted: EU hosting with ISO 27001-certified partners.
What happens to our data with AI?
We only use models covered by a data processing agreement. Your data does not train models, and it stays in the EU.
What is in the contract?
The agreement, the scope with numbered functions, the SLA and the data processing agreement.
Who owns the software?
You do. The rights transfer per phase, once that phase is paid. No licence.
Who maintains it?
We do, under an SLA. Or you do: the documentation is written for that.
Show us one process that could be lighter.
No obligation · six questions · reply within one to two working days. Or get in touch