Compliance Center
The paperwork, written from what actually ran.
Your Art. 30 processing record and your EU AI Act deployer documentation are generated from the audit trail, not typed into a template from memory. The systems, the regions, the categories of data and the models that served them come from the platform, so the document and the behaviour cannot drift apart.
records · evidence · export
Generated from the trail, so the date is the date it was true.
The document says one thing. The system does another.
A processing record is written once, in a spreadsheet, by someone reading a design document. Then the model changes, a region is added, a team wires up a new tool, and nobody updates the file. The gap between the paperwork and the behaviour is invisible until a regulator or a customer's security review goes looking for it, and by then it is a finding rather than a fix.
How it works
Generated, reviewed, exported.
The Compliance Center reads the same trail every service writes to. You review what it found and add the context only you have.
- 01GeneratedBuilt from behaviourSystems, purposes, regions, categories of data and the models that served them come from what actually ran, so the record starts from evidence rather than recollection.
- 02ReviewedYours to completeThe platform knows what it did. It does not know your legal basis, your retention reasoning or your controller relationships, so those stay yours to state.
- 03ExportedHanded over wholeExport the record for a date range, with the residency evidence and the sub-processor list beside it, and give a reviewer a set rather than a story.
Two of these are yours to write. We do not pretend otherwise.
Why it is different
Evidence, not a template.
A compliance module that gives you a blank form has moved the work, not done it. This one starts from the record of what your organization actually did.
Built from the trail
The same rows that record every request build the report, so the document describes the system rather than the intention.
Refusals count as evidence
A blocked non-EU route is proof that the control works. Residency evidence includes what was stopped, not only what was allowed.
Honest about its limits
Legal basis, retention reasoning and controller relationships are yours. The platform fills in what it can prove and leaves the rest visibly empty.
Not a certification
These are your records, generated well. They are not an audit, an attestation or a certificate, and we will not present them as one.
What it produces
Documents a reviewer will accept.
GDPR Art. 30
A record of processing activities covering the systems, purposes, categories of data, regions and transfers the platform observed for your organization.
EU AI Act deployer record
Which models were used, for which purpose, in which region, and under whose oversight, assembled from the same trail.
Residency and sub-processors
Requests by region with refusals included, and the current sub-processor list, so the transfer questions have documents behind them.
FAQ
Questions people ask about the Compliance Center.
- Where does the content come from?
- The audit trail. Systems, regions, categories of data and the models that served each request come from what actually ran.
- Is this a certification?
- No. These are your own records, generated from evidence. They are not an audit, an attestation or a third-party certificate.
- What do we still have to write ourselves?
- Your legal basis, your retention reasoning and your controller and processor relationships. The platform cannot know those, and it leaves them visibly empty rather than guessing.
- Does it cover all three products?
- Yes. Chat, Code and the API write to the same trail, so one record covers the organization rather than one application.
- Can we export it?
- Yes, for a date range, with the residency evidence and sub-processor list beside it.
Start here
Let the record write the record.
Create a key and the trail starts filling. The Art. 30 and EU AI Act documents build themselves from it as you go.