Conformant — Security overview (informational)
=============================================

Product
  Conformant is an EU AI Act compliance workspace for recruitment and
  staffing agencies. Customers manage AI inventories, classifications,
  obligations, evidence, documents, deadlines, and related team activity.

EU hosting
  Primary workspace data (database and file storage) is hosted in the
  European Union via our database provider. We select infrastructure and
  vendors with data processing agreements appropriate to that processing.

Authentication and access
  Sign-in is handled by Clerk with industry-standard authentication.
  Access inside the product is scoped to the customer's organization.
  Admins manage settings, billing, teammates, and the workspace audit log.
  Members can work on day-to-day compliance tasks within that org.
  Single sign-on (SSO) is available for larger teams — contact us to enable.

Encryption
  Data is encrypted in transit (HTTPS/TLS). Database and storage providers
  encrypt data at rest as part of their platform security.
  Evidence files are stored in private buckets, not on public URLs.

Backups and availability
  We rely on managed database infrastructure with automated backups and
  monitoring. The product is designed to fail safely (for example, dashboard
  access defaults to locked when authentication or billing state cannot be
  verified).

Retention (summary)
  Workspace data is kept while a subscription or trial is active.
  Admins can export workspace data from Settings before deletion.
  When a workspace is deleted, we remove database rows and stored files
  within a reasonable period, except records we must retain for law
  (for example billing). See the Privacy Policy for fuller detail.

Audit log
  Organization admins can review an append-only trail of workspace changes
  (inventory, classifications, obligations, deadlines, documents, team and
  settings changes). The audit log complements exported PDFs; it is not a
  substitute for your own legal records-retention policies.

Incident / security contact
  Email hello@conformant.eu with details if you notice a suspected security
  issue or unexpected access.

This file is informational only — not a certificate or audit attestation.

Last updated: July 2026
