A compliance product is only as good as the jurisdiction it sits in.
Ansikt is hosted, governed and built in the EU — under Danish and EU law, on infrastructure we operate. Here's the short version, with the receipts.
Where we hold the line.
Stay in the bloc.
Infrastructure, sub-processors, employees, jurisdiction. Every lever is European. Schrems II was decided in 2020; the response was building things differently, not waiting for the next ruling.
- Hetzner · Frankfurt & Falkenstein
- Scaleway · Paris
- Datacentre tenancy · ISO 27001
- EU-only operator access
Hold less data.
One 512-dim vector per face. The original photo never leaves your source. We don't make copies. Article 5(1)(c) — data minimisation — is a daily engineering constraint, not a policy paragraph.
- Vectors only · no image copies
- Customer-managed encryption keys
- Tenant isolation at storage layer
- Erasure verifiable in < 24h
Show your work.
Every search, every export, every operator action is logged in a tamper-evident, hash-chained ledger. Streamable to your SIEM. Auditors see a full picture without us in the room.
- Append-only audit log
- SHA-256 hash chain
- SIEM stream · CEF or JSON
- Quarterly third-party log review
What we hold, and what's in flight.
We don't claim certifications we don't have. Status is updated quarterly; the audit dates are real.
From your source to the answer, in one diagram.
No black boxes. Every hop is named, every protocol is logged. The image stays where it lives — only the vector travels.
The everyday stuff, written down.
The whole list. Four names.
Every sub-processor is European, with a current DPA on file. We notify customers 30 days before any addition or change.
Found something? Tell us.
We answer security mail in under one business day. Coordinated disclosure is honoured; we credit reporters by name unless asked otherwise.
Vulnerability disclosure.
Email a description of what you found, where, and how to reproduce. We acknowledge in 24 hours, fix critical issues in 72, and publish an advisory once customers are protected.
Procurement, DPAs, audit questionnaires.
If you're filling out a vendor risk form, send it. We have a SIG-Lite, a CAIQ, and a current DPA template ready to go. We'll get it back inside three days.