Compliance & Trust

Privacy is a systems-engineering and operational principle for us, not a notice added after a product is built. We design around data minimisation, local processing and clear user control, then carry those principles into how we build and operate the product.

In earlier professional work, our founder, Dr. Georgios Kalogridis, received an acknowledgement letter from Ontario's Information and Privacy Commissioner concerning that work's alignment with Privacy by Design requirements. This recognition relates to past work; it is not a certification, audit or endorsement of Privalyx.

Privalyx is a locally installed product, not a hosted SaaS application that centrally processes customer project datasets. Core project workflows run in the customer's environment. Optional services, such as external AI or sync, have their own data flows and should be assessed against the customer's requirements before use.

We are building our security and operational controls with the SOC 2 Trust Services Criteria as a reference point. Privalyx is not currently SOC 2 audited or ISO certified. Our goal is to mature these controls and pursue ISO/IEC 27001 certification as the organisation and its operating programme develop.

We design with relevant European privacy and AI requirements in view, prioritising clear data boundaries, human oversight and accountable use. The EU AI Act takes a risk-based approach: obligations depend on an AI system's role, risk classification and intended use, rather than applying one blanket standard to every AI feature.

Where a customer chooses to use Microsoft AI, we consider Microsoft's published Responsible AI governance and EU AI Act guidance. These provider resources are one part of the governance picture, not a blanket guarantee of compliance: Privalyx remains responsible for its integration, and each organisation must assess its own deployment and use case.