Trust by design
Built to be put in front of a board.
EU-sovereign infrastructure, documented controls, and a research-grade method. Verifiable, not asserted.
Three principles, no exceptions
EU Data Sovereignty
All AI processing routes through European infrastructure (AWS Bedrock, Ireland). Your data never crosses borders. Signed Data Processing Agreements with our sub-processors, tracked in a live register.
Compliance-First
Aligned with EU AI Act, GDPR, and ISO 27001. Weekly compliance assessments, not annual audits. We track 193 requirements across four frameworks continuously.
Transparent AI
Full observability. Every analysis traced, every recommendation explained, every decision logged. AI outputs are flagged as AI-generated. Nothing happens in the dark.
EUROPEAN UNION
AWS BedrockIreland · eu-west-1
Anthropic ClaudePrimary model
ScalewayParis · EU-sovereign cloudNext
All data stays inside the EU, by design.
Certifications & frameworks
We're explicit about what's certified, what we're aligned to, and what's in progress, because a trust page should be auditable, not aspirational.
GDPR
Compliant. DPA, Standard Contractual Clauses, right to erasure, and data export in place.
LiveEU data residency
Enforced, fail closed. AI requests that cannot be routed inside the EU fail rather than leave it, and EU endpoints for voice are enforced at server startup.
LiveAIUC-1 (AI security standard)
Aligned. Assessed weekly against 51 requirements; results tracked and published.
ContinuousEU AI Act
Aligned. Transparency, human oversight, and audit obligations built into the product.
ContinuousISO 27001
Framework-aligned; our EU data center (Scaleway, Paris) is ISO 27001-certified.
AlignedSecure development
Developing with frontiers
Security is a property of how software is built, not a layer added at the end. Every change to 360 Sprint is scanned before it can reach production, and we hunt for vulnerabilities in our own code with Anthropic's most capable models.
Anthropic Cyber Verification Program
Anthropic has verified 360 Sprint for its Cyber Verification Program. The verification covers our identity, the defensive nature of our security work and the controls we keep around it. It gives us access to Anthropic's most capable models for security work, including Claude Mythos.
A verification of how we work. Not a certification of our product.
How AI is used in 360 Sprint
Transparency is required by the EU AI Act and is part of how we work. Here is exactly what AI does, and does not do, with your data.
Models we use
Anthropic Claude is the primary model, served via AWS Bedrock in Ireland. Routing fails closed: a request that cannot be served inside the EU fails rather than leaving it. No provider trains models on your data.
What we never send
Personal data classified as RESTRICTED, including national ID numbers and payment card data, never leaves our infrastructure. On every strategy analysis, requests containing such data are blocked before they reach an AI provider. (Baseline configuration — the exact action for ID/card data is environment-managed and may vary by path; request our live evidence pack for the current attested behaviour.)
What is sanitized
Names, emails, phone numbers and addresses are masked by our Data Guardian before any strategy-analysis prompt is sent. The model sees placeholders, not real people. (Baseline configuration — PII-anonymization actions are environment-managed and under active review, so the live action may differ. Request our evidence pack for the current attested behaviour.)
Every AI call is logged
Provider, model, input hash, output hash and timestamp are recorded for every AI request. A complete audit trail is available on request.
Customer recordanna@nordco.dk••••••••
Strategy canvasNordics expansion••••••••
Chat history“Why is churn up?”••••••••
AI Governance
Aligned with AIUC-1, the AI security standard
AIUC-1 is an independent AI security framework that assesses 51 requirements covering everything from prompt injection defense to agent orchestration safety. We run it weekly.
Most companies do annual security audits. We run AIUC-1 compliance sprints every week, tracking risk scores, closing gaps, and publishing results transparently. Built on Anthropic Claude with purpose-built harness and session persistence. Being aligned with AIUC-1 shows we are not just using AI. We are governing it responsibly.
See the live compliance resultsData protectionSecuritySafetyReliabilityAccountabilitySocietal impact
requirements
6principles
AIVSSrisk scoring
Live system status
Real-time status of every 360 Sprint service. No "trust us". Just look.
System Status
status.360sprint.dkLoading status...
This week's assessmentAuto · every week
AIUC-1Audit-log retentionGapClosed
GDPRDPA · new sub-processorGapClosed
EU AI ACTAI-content markingGapClosed
open gaps: found, prioritized and closed within the week
Sub-processors & data processing
Every third party that touches your data: what they do, where they sit, and how the transfer is safeguarded. Reviewed and kept current.
| Provider | Purpose | Location |
|---|---|---|
| AWS Bedrock (Claude AI) | AI inference (strategic analysis) | EEA/EU · Ireland |
| Railway | Application hosting | EEA/EU · Netherlands |
| Scaleway Managed Database | Primary database | EEA/EU · France |
| Scaleway Object Storage | File storage | EEA/EU · France |
| Clerk | Authentication & user management | USA · USA |
GDPR Compliance
Full EU GDPR compliance with data processing agreements and right to erasure.
Data Processing Agreement
Transparent data processing with all AI providers. View our DPA and sub-processor list.
View DPASecurity contact
Found a vulnerability, or need our DPA, sub-processor register, or compliance results for a security review? Email security@360sprint.dk. Our security and data-protection team responds directly. Data Protection Officer: Daniel Wegener, 360 Sprint ApS.
Security questions
Where is my data stored and processed?
All business data and AI processing stays in EU data centers (Scaleway Paris, AWS Bedrock Ireland). Authentication is handled by Clerk under the EU-US Data Privacy Framework with signed DPA and Standard Contractual Clauses.
Can AI providers use my data to train their models?
No. All AI processing runs on AWS Bedrock in the EU. Neither AWS nor Anthropic use your data for model training. Your strategy data stays yours.
Can I show this to my DPO or board?
Yes. We have a transparent trust centre, data processing agreement, compliance dashboard, and sub-processor list, all ready to share with your Data Protection Officer or board.
What is AIUC-1?
AIUC-1 is an independent AI security framework that assesses 51 requirements across categories like prompt injection, data sovereignty, and agent orchestration. We assess against it weekly, not annually, because AI risk moves faster than annual audits.
Can we sign a DPA, and do you keep a sub-processor list current?
Yes. A signed DPA is available before onboarding, and our full sub-processor register (provider, purpose, location, encryption, and transfer safeguards) is published and kept current. Both are ready to forward to your legal and procurement teams.
Is 360 Sprint certified, or aligned?
We're explicit about the difference. GDPR compliance and EU data residency are enforced today; AIUC-1, the EU AI Act, and ISO 27001 are assessed continuously, with our EU data center ISO 27001-certified. We publish what holds and what's in progress.
Security you can show your board.
European infrastructure, weekly compliance sprints, and full transparency.
Looking at how the AI itself behaves: human oversight, accountability, the EU AI Act? See Responsible AI
Behind the commitments
These commitments are informed by 360° Sprint, the strategy consultancy practice we have run since 2016. About the firm.