IVERIOS OÜ · Trust Center
Security, privacy and compliance at IVERIOS
IVERIOS OÜ (Tallinn, Estonia) provides IVERIOS Trust Center, IVERIOS Management and related AI services. Ostendo Consulting d.o.o. (Zagreb, Croatia) operates the services on its behalf, and they are hosted in the European Union (Germany). The company runs an information security management system aligned with ISO/IEC 27001:2022, with certification in preparation.
- ✓ ISO/IEC 27001
Last updated: November 6, 2026
At a glance
Security controls
37 security controls in place
- Organisation and governance6
- Infrastructure security6
- Data protection7
- Application security6
- Access management6
- Incident response4
- Business continuity2
Privacy
- Data location:
- European Union (Germany)
Subprocessors
6 subprocessors
Ostendo Consulting d.o.o. · Hetzner Online GmbH · Microsoft Ireland Operations Ltd · Anthropic PBC · Revolut Bank UAB …
View details →FAQ
- › Where is our data stored?
- › Is our data used to train AI models?
- › How quickly will we be notified of a data breach?
🔒 Available after sign-in and approval
Approved customers and partners get access to:
- 📄 Additional security and compliance documents (e.g. audit reports, policies)
- 💬 AI assistant for questions about security and compliance
- 📋 Automatic completion of your security questionnaires
Certificates
Scope
Design, development, operation, maintenance, and support of AI-powered software platforms and SaaS solutions for information security, risk management, regulatory compliance, and secure information sharing.
Regulations
IVERIOS acts as controller for its own customer, website and contact data and as processor for data in customers' trust centers. Processing as processor is governed by a Data Processing Agreement under Article 28 GDPR. Sub-processors are published and changes are announced 30 days in advance. Data subject rights are handled via info@iverios.eu within one month. Personal data breaches are notified to customers without undue delay, and in any case no later than 72 hours.
IVERIOS services offer AI features (document classification, translation, content suggestions, questionnaire answering, visitor assistant, redaction) based on Anthropic Claude. The AI Use and Data Policy requires the customer to review and approve AI suggestions before publication. Questionnaire answers are marked with confidence and sources. The assistant tells visitors when information is not available. Prompt-injection and misuse protections are applied.
Security controls
Organisation and governance
- Information security management system and policiesThe Information Security Policy is the top-level document of an ISMS aligned with ISO/IEC 27001:2022. It is supported by policies on access control, incident response, business continuity and backup, secure development, vulnerability management, AI use and privacy. Management approves the policy and reviews it annually.
- Information security risk assessmentRisks are identified, assessed and treated at least annually and whenever significant changes occur, such as a new service, a new sub-processor or a significant incident. Risk treatment decisions are documented in a risk register approved by management.
- Security awareness training for employeesAll staff complete security onboarding before access is granted and receive continuous security training.
- Background checks and confidentiality agreements for staffEveryone signs an NDA, and accounts are created only after the NDA is signed. Background checks are not described in the sources.
- Supplier and third-party risk managementSub-processors are assessed before use and bound by data processing agreements with equivalent obligations. The sub-processor list is published, and customers are informed of intended changes at least 30 days in advance.
- Internal audits and management reviewCompliance with the security policy is reviewed at least annually and after significant incidents. A security responsible person reports to management at least quarterly. A formal internal audit programme is not described.
Infrastructure security
Privacy
IVERIOS OÜ is the controller for data about its own customers, website visitors and people who contact it. It acts as a processor, under a Data Processing Agreement (Art. 28 GDPR), for personal data in customers' trust centers. Only data needed for the service is processed. No advertising trackers are used and personal data is not sold. Account data is kept for the duration of the contract and 12 months after the service stops, and security logs for up to 12 months.
- Data location
- European Union (Germany)
- Data protection officer
- info@iverios.eu (no DPO appointed; privacy matters handled by management)
International data transfers
Personal data is transferred to the following third countries: United States
Additional measures: Only the data needed for the specific AI task is sent to Anthropic, and this data is not used for model training. Highly confidential data is processed on IVERIOS-operated GPUs and AI models and is not sent to third-party AI providers.
Subprocessors
| Name | Purpose | Location | Transfer |
|---|---|---|---|
| Ostendo Consulting d.o.o. | Development, operation and support of IVERIOS services on behalf of IVERIOS OÜ | Croatia (EU) | EU/EEA – no transfer |
| Hetzner Online GmbH | Infrastructure hosting (servers, storage) | Germany (EU) | EU/EEA – no transfer |
| Microsoft Ireland Operations Ltd | E-mail delivery (Microsoft 365 / Graph), staff identity (Entra ID) | European Union | EU/EEA – no transfer |
| Anthropic PBC | AI processing (Claude API): classification, translation, content suggestions, questionnaires, assistant, redaction | United States | Standard Contractual Clauses (SCC) |
| Revolut Bank UAB | Payment processing for credit purchases and licences (card payments — being introduced) | European Union (Lithuania) | EU/EEA – no transfer |
| TIG revizija | Accounting and bookkeeping | Croatia (EU) | EU/EEA – no transfer |
Documents
Policies
- TXT↓ DownloadAI Use and Data Policy3 kB
Privacy
- TXT↓ DownloadPrivacy Policy3 kB
Subprocessors
- TXT↓ DownloadSub-processor List2 kB
Contracts & terms
- TXTData Processing Agreement (template)4 kB
FAQ
›Where is our data stored?
Data is stored in the European Union (Germany), on dedicated infrastructure at Hetzner Online GmbH. AI processing via Anthropic may involve processing in the United States, covered by EU Standard Contractual Clauses.
›Is our data used to train AI models?
No. AI features use Anthropic Claude through the commercial API, and data sent through the API is not used to train models. Only the data needed for the specific task is sent.
›How quickly will we be notified of a data breach?
Without undue delay, as a rule within a few hours of IVERIOS becoming aware of the breach and in any case no later than 72 hours.
›Does IVERIOS hold ISO/IEC 27001 certification?
Not yet. The information security management system is aligned with ISO/IEC 27001:2022, and certification is in preparation.
›Will we be informed about changes to sub-processors?
Yes. The sub-processor list is published, and customers are informed of intended changes at least 30 days in advance. Customers have the opportunity to object.
›Is the service independently penetration tested?
Yes. An independent penetration test is performed annually and after major changes. A summary is available to approved customers under NDA.
Ask your AI assistant about us
Copy this message into ChatGPT, Claude, Gemini or another AI assistant — it will read our published security information and answer your questions.
Read https://trust.iverios.eu/iverios-ou/llms.txt and summarise the security and compliance of IVERIOS OÜ: certifications, regulations, security controls, data location and sub-processors. Then answer my questions using only that information.
Connect your AI assistant
Let your AI assistant (Claude, ChatGPT or another MCP client) look up information from this trust center directly. Access is read-only and every request is logged.
With sign-in (approved visitors)
Everything you can see after signing in. Your assistant will ask you to sign in and allow access.
https://trust.iverios.eu/iverios-ou/mcpWithout sign-in
Public information only.
https://trust.iverios.eu/iverios-ou/mcp/public- Claude: Settings → Connectors → Add custom connector → paste the address, then enable the connector in your chat.
- ChatGPT: Settings → Connectors → Advanced → Developer mode, then Create → paste the address (for the public address choose no authentication).
- Claude Code:
claude mcp add --transport http iverios-ou https://trust.iverios.eu/iverios-ou/mcp/public
Contact
Questions about security or a possible vulnerability? Contact us.
