DATA SECURITY

Client data — in EU jurisdiction.
Always.

CHEVORA is incorporated in Estonia (EU). All servers are in Germany. Data never leaves EU jurisdiction. GDPR-native from day one.

Jurisdiction:Estonia · EU

Servers:Germany · EU

GDPR:Art.6(1)(b)

DPIA:Signed 2026-04-22

Vaultinum IP:IDDN.SK.003.210001.001

Reg. No.:17237686 · CHEVORA OÜ

Data Storage & Processing

Server jurisdictionEuropean Union (EU) — exclusively

Supabase EU West (Frankfurt, DE) · Hetzner (Nuremberg, DE)

Client dataNever leaves EU jurisdiction

Under no circumstances is client data transferred to servers outside the EU

Third partiesNot transferred

Client data is never sold or shared with analytics or marketing platforms

Retention periodMinimum necessary

Order data — until fulfilment + 90 days. Deleted upon client request.

EU Regulatory Compliance

GDPRArt.6(1)(b) — performance of contract

Legal basis for processing: performance of contract with the client

DPIASigned · 2026-04-22

Data Protection Impact Assessment completed and documented

SubprocessorsSupabase DPA signed

Data Processing Agreement with Supabase signed 22.04.2026

EU AI ActCompliant

Platform complies with EU AI Act requirements — AI usage is documented

Intellectual Property Protection

IP DepositVaultinum v3.0

IDDN.SK.003.210001.001 · 26.05.2026 · Notarised source code deposit

TimestampBitcoin OTS #951130

Cryptographic timestamp anchored to the Bitcoin blockchain

Protection regimeTrade secret

Verification methodology and algorithms protected as trade secrets

Infrastructure Security

Data accessLeast privilege

RLS (Row Level Security) on all Supabase tables · access limited to own data only

Data in transitTLS 1.3 everywhere

All connections encrypted · HTTPS enforced

AuthenticationPasswordless

Magic link via email · no persistent passwords stored in the database

Monitoring24/7 automated

Hetzner Worker · health checks · alert on source failure

Data Subject Rights

Data accessOn request within 30 days

Submit a data access request to: info@chevora.ai

ErasureOn request within 30 days

Right to erasure: all client data deleted in full

PortabilityJSON export

Data provided in machine-readable format

ComplaintsDPA · EDPB

Supervisory authority: Andmekaitse Inspektsioon (Estonia) · or any EU supervisory authority

Security enquiries

Security questionnaire, subprocessor list, DPA copies — request at info@chevora.ai

info@chevora.ai →