--- title: "How we handle data: compliance and sovereignty in the Lab" description: "How SIMO GmbH handles data in the SIMOSphere AI Lab: what is in place, what is in preparation, and what is not. GDPR, EU AI Act, ISO/IEC 27001, BSI C5, sub-processors." canonical: "https://simosphereai.com/en/compliance" lang: en --- # How we handle data: compliance and sovereignty in the Lab How SIMO GmbH handles data in the SIMOSphere AI Lab: what is in place, what is in preparation, and what is not. GDPR, EU AI Act, ISO/IEC 27001, BSI C5, sub-processors. **How we handle data.** This page states plainly how SIMO GmbH handles data in its systems and in the Lab: what is in place today, what is in preparation, and where we deliberately are not yet. ## 1. GDPR: what is in place and how it is evidenced Our own assessment, not an external audit. We do not put a percentage on it: nobody outside could recheck a figure like that. What follows are the points that actually matter. Where a company brings its own personal data into a Lab project, SIMO GmbH first concludes a data processing agreement under Article 28; how that works is set out on its own page. - Seven active sub-processors, documented, with four weeks’ notice before any change, as Article 28(2) GDPR requires. - Operations in the EU: compute and backups at Hetzner in Germany, model inference at Modal Labs in Frankfurt. - Data subject rights under Articles 15 to 22 GDPR: access and export on request, plus a documented deletion matrix. - A data protection impact assessment under Article 35 exists for analytics; every new AI feature gets its own before it goes live. ## 2. EU AI Act: which duties apply and how they are met Risk classification is mostly minimal; individual workflows fall under the transparency obligations of Article 50, often called limited risk. In the Lab, SIMO GmbH is a deployer within the meaning of Article 3(4): it uses third-party general-purpose models, namely Apertus 8B and the Mistral family, for its own tests. It places no AI system on the market through the Lab. - The transparency obligations under Article 50 are met: every AI-generated answer in the Lab’s systems is marked as such through a dedicated response header and a visible notice. - Model cards for Apertus 8B and the Mistral family, with provider, license, knowledge cutoff, and usage limits. - Every model call is logged for thirty days with model ID, client hash, token count, and response hash. - No high-risk system: no use case in the Lab falls under Annex III today, so no biometric scoring, no candidate screening, and no education ranking. ## 3. ISO/IEC 27001: in preparation Work on Annex A is underway, and some measures are still outstanding. The certification audit is planned for 2027; there is no certificate today. Asset inventory, risk register, statement of applicability, and incident response are being built out; document control runs through the repository. Hetzner, who runs the infrastructure, is certified to ISO/IEC 27001. At that layer the benefit already applies. ## 4. BSI C5: preparation from Q4 2026 Mapping the C5:2020 controls onto existing measures is underway, starting with operations, identity management, and key management. No attestation has been issued to date. ## 5. Accessibility: partially compliant Voluntary commitment to WCAG 2.1 Level AA, partially met today. The accessibility statement is published and lists the known limitations and the feedback channel. ## 6. Schrems II and third-country transfers The transfer impact assessment methodology is documented; the EU standard contractual clauses 2021/914 are in place with every US sub-processor wherever processing takes place in the United States. The default is processing inside the EU. A transfer to the United States happens only when the relevant connector, such as Tavily or Microsoft Graph, is deliberately switched on for a project. Microsoft is certified under the EU-US Data Privacy Framework. ## 7. Data sovereignty: where everything lives *Data types, storage locations, and encryption* | | Storage location | Encryption | | --- | --- | --- | | Client project databases (PostgreSQL) | Hetzner, Germany | TLS in transit, LUKS at rest, column encryption for secrets with a rotating master key | | Backups (daily, kept for thirty days) | Hetzner Storage Box, Germany | AES-256 on a separate key path | | Language model prompts and responses | Modal Labs, Frankfurt | TLS in transit, no retention at the model backend | | Uploaded files | Hetzner and Cloudflare R2 in EU buckets | TLS in transit, AES-256 at rest | | Authentication secrets | Hetzner, Germany | Argon2id for passwords, master key held apart from the signing key | | Support requests | Hetzner, Germany | TLS in transit, LUKS at rest | ## 8. Sub-processors: all seven of them Role, region, and contractual basis for each provider. Clients with a data processing agreement are notified of any change by email four weeks in advance, as Article 28(2) GDPR requires. *Active sub-processors as of October 6, 2026* | | Role | Region | Safeguard | | --- | --- | --- | --- | | Hetzner Online GmbH | Servers, storage, backups | Germany | Processing agreement, ISO/IEC 27001 | | Cloudflare, Inc. | DDoS mitigation, firewall, DNS, tunnel | Global, EU-fronted | Processing agreement, EU standard contractual clauses, ISO/IEC 27001 | | Modal Labs, Inc. | Compute for language models | EU (Frankfurt) | Processing agreement, EU standard contractual clauses, no retention | | Tavily, Inc. | Web search, only with the client’s consent | United States | Processing agreement, EU standard contractual clauses | | Microsoft Corporation | Microsoft 365 connector, only with the client’s consent | EU, at the client’s choice | Processing agreement, EU standard contractual clauses, EU-US Data Privacy Framework | | GitHub, Inc. | Source code hosting, no client data | United States | Processing agreement, EU-US Data Privacy Framework | | GitGuardian, Inc. | Secret scanning, no client data | EU | Processing agreement | ## 9. Certificates: only what genuinely exists This section lists what we actually hold. External audit certificates are not among them yet. We keep the entries visible as an honest signal. - ISO/IEC 27001: targeted for 2027. - BSI C5: preparation from the fourth quarter of 2026. - TISAX: no assessment so far; on request. ## 10. Contact and requests For compliance inquiries, data processing agreements, vendor reviews, or auditor access. Postal address: SIMO GmbH, attn. Compliance, Würzburger Straße 152, 63743 Aschaffenburg, Germany. This page is reviewed at least quarterly, and additionally whenever the systems change materially. - Compliance: compliance@simo-online.com - Data protection: datenschutz@simo-online.com - Accessibility: barrierefreiheit@simo-online.com ## Go deeper - [Data processing in the Lab](https://simosphereai.com/en/compliance/dpa) - [EU AI Act guide](https://simosphereai.com/en/guides/eu-ai-act) - [Accessibility statement](https://simosphereai.com/en/accessibility) Rendered version: https://simosphereai.com/en/compliance