Chronological updates to the trust documentation. Each entry has a date and a snapshot version, so any DPA reference can be reproduced at a later date.
Aligned with the DPA: breach notification within 48 hours (DPA art. 11.2); retention after termination as in DPA art. 12, replacing the six-month window; backup retention per data store (database 7 days, document versions 30 days). AI safety: the organisation administrator decides which external AI providers are allowed, and a new provider is never enabled for an existing organisation without explicit consent. Infrastructure: hosting and Mode A processing within the EEA, with Mode B outside the EEA only after screening; segregated development and production environments instead of network segmentation per customer. Retention periods described per type of data. DDoS protection by the hosting providers instead of a WAF; model evaluation described as practised; short-lived per-user tokens for document retrieval; document deletion with the expiry of backups and previous versions. AI incidents: handled under the incident procedure, with article 73 of the AI Act applying only to an agreed Annex III use. Sharpened from the external attack-surface assessment of October 2026: transport encryption, public ingress, multi-tenant isolation and access tokens; added token validation, unauthenticated API access, no secrets in browser code, email spoofing protection and the assessment itself. Documents package (DPA, AI Annex, Terms) regenerated on 27 October 2026 to carry Localign's legal address at Sint Janssingel 92, 5211 DA 's-Hertogenbosch (correcting a 2 October regeneration that had used the post address at number 88).
Controls coverage audit aligned with the ISMS Statement of Applicability. AI safety expanded with Mode A as default, customer attestation on article 5 prohibited practices, and FRIA building blocks. Data and privacy expanded with the six-month post-termination retention. Wording aligned (Mode B) where the English page had used the Dutch spelling.
Initial publication of the Trust Center: five hubs (Compliance, Resources, Controls, Sub-processors, Updates) and their sub-pages.
Changes that lower the level of protection are actively communicated to customers via the contact in the DPA, in line with the DPA change-notification article.
We usually answer questions from CISOs, DPOs and procurement teams within two working days.
