Built for GDPR and the EU AI Act

GDPR applies whether processing is performed by a person or by AI. INSTRAT360 is designed around the regulation's core obligations.

• Clear controller/processor roles, with a Data Processing Agreement available for enterprise customers.
• Data minimisation and purpose limitation — we process workspace data only to deliver the service.
• Explicit retention rules for chats, files, memory, generated outputs and audit records.
• Support for access, correction, export and deletion of personal data.
• Tenant isolation and least-privilege access across the platform.
• A subprocessor register with change notification for enterprise agreements.
• EEA processing preference, with valid transfer safeguards where data leaves the EEA.
• DPIA support for high-risk personal-data processing, and an incident process aligned to the 72-hour notification requirement.

Every AI capability in INSTRAT360 is built to be transparent, accountable and human-supervised — designed for the EU AI Act's transparency obligations (Article 50) ahead of their application.

• AI interaction and AI-assisted outputs are clearly identified in the product.
• AI recommendations stay visually distinct from verified facts and deterministic calculations.
• The AI cannot approve its own work — consequential actions require explicit human approval.
• Users can stop, override and correct AI output at any point.
• Each capability records its intended purpose, provider, model version, data categories, sources and human owner.
• Prohibited uses are blocked, and high-risk personal decisions (e.g. employment or creditworthiness) are not enabled without a separate high-risk assessment.

Because CEOs and CFOs work with sensitive business information, numeric integrity and traceability are part of the product.

• Financial calculations use deterministic functions — not model guesses.
• Forecasts, assumptions and data-as-of dates are shown alongside the numbers.
• Narrative, tables and charts draw from identical canonical values.
• Every recommendation retains its sources and calculation method.
• Read-only integration access is the default; external writes require explicit approval.
• Approved reports and decisions are reproducible, with an audit trail of who asked, what the AI proposed, what changed, who approved and what executed.

Our security baseline is designed to be NIS2-aligned, with a financial-services overlay available where DORA applies.

• Strong authentication, multi-factor support and role-based access control.
• Complete tenant separation and encryption in transit and at rest.
• Secure secrets handling, dependency and vulnerability management.
• Audit logs protected from ordinary modification.
• Backup, restore and disaster-recovery practices.
• Incident detection and response, with penetration testing and supplier/model-provider risk review before production use with real data.

You stay in control of your data — supporting the EU Data Act's switching and portability expectations.

• See where data is stored and which providers, subprocessors and integrations are active.
• Control retention and memory, and disable a model, tool or automation.
• Export source files, artifacts, audit history and relevant metadata.
• Remove integrations and credentials, and delete a workspace with confirmation.
• Reproduce an approved decision or deliverable — no lock-in to inaccessible data.