EcoSphereTrust CentreEcoSphereYour data is safe.
We can prove it.
EcoSphere is built on a foundation of GDPR compliance, EU data sovereignty, and transparent AI governance. This page documents every measure we take to protect you, your customers, and their data.
Built for compliance from day one
Every layer of our platform — infrastructure, contracts, AI, and access control — is designed to meet or exceed European regulatory standards.
GDPR Compliant
EU 2016/679
EU Data Residency
Microsoft Azure Norway/West EU
EU AI Act Ready
2024/1689 assessment underway
AES-256 Encryption
At rest and in transit
Multi-Tenant Isolation
Row-Level Security
RBAC Access Control
Role-based, least-privilege
Full Audit Trail
All actions logged
Automated Backups
7–35 day retention
Legal agreements — in place
We don't just promise compliance — we've signed the contracts. Every mandatory agreement required under GDPR is executed and active.
Data Processing Agreement (DPA)
EcoSphere AS ↔ Takstgruppen AS — GDPR Article 28
- Defines EcoSphere as Data Processor, Takstgruppen as Data Controller
- Covers all processing purposes: ESG reporting, AI analysis, emissions calculations
- Includes 24-hour breach notification obligation to the controller
- Governs sub-processor chain (Microsoft Azure, OpenAI, Climatiq)
- Audit rights and data deletion/return obligations on termination
- Governing law: Norwegian law / GDPR as applicable through EEA Agreement
Privacy Policy
Published & accessible to all platform users
- Identifies EcoSphere as data controller for platform accounts
- Discloses all purposes and legal bases under GDPR Article 13/14
- Explains AI processing and what data is involved
- Documents data subject rights: access, erasure, portability, objection
- Lists all sub-processors and international transfer mechanisms
- Contact information for data protection queries provided
Terms of Service
Binding agreement for all platform users
- Defines permitted use of the platform and acceptable content
- Clarifies IP ownership: customers own their data and report outputs
- AI output disclaimer — outputs are advisory, subject to human review
- Liability limitations and indemnification clauses
- Account termination procedure and data retention/deletion post-termination
- Mandatory acceptance required before account creation
How we protect your data
From the moment data enters our platform to the moment you choose to delete it, every step is governed by strict technical and organisational controls.
EU Data Sovereignty
- All data hosted in Microsoft Azure EU regions (Norway North / West Europe)
- No data stored outside the European Economic Area
- Microsoft Azure holds ISO 27001 and SOC 2 Type II certifications
- Azure Standard Contractual Clauses (SCCs) in place
Encryption & Security
- AES-256 encryption at rest (Azure SQL TDE + Blob Storage)
- TLS 1.2+ encryption in transit — no weak cipher suites
- All secrets managed via Azure Key Vault
- Automated security patching on all infrastructure components
Access Control & Isolation
- Each organisation is fully isolated at the database level (Row-Level Security)
- Role-Based Access Control (RBAC) enforced on every API endpoint
- Least-privilege principle — users only see their organisation's data
- Partner/consultant access only when explicitly granted by client
Audit & Accountability
- Every user action, data access, and login event is logged
- Audit logs include timestamp, user identity, and action type
- Logs retained for minimum 12 months
- Takstgruppen administrators can access logs for their client data
Responsible AI — not a buzzword
We use AI to help you work faster — but we never let it make decisions for you. Every AI output is advisory, transparent, and auditable.
Our AI Commitments
- Human-in-the-loop: Every AI output requires human review before use in reports or decisions
- No training on your data: Your uploaded documents and reports are never used to train AI models
- EU data residency for AI: AI processing via Azure OpenAI Service — targeted EU region
- Transparency labelling: All AI-generated content is clearly labelled as AI-assisted
- Audit trail: All AI inputs and outputs are logged with timestamps for 6+ months
- Right to contest: Users can review, edit, or reject any AI suggestion before it takes effect
EU AI Act Readiness
EU AI Act high-risk obligations effective August 2026. Conformity assessment in progress ahead of deadline.
Your rights under GDPR
As a data subject or data controller, you have clearly defined rights. We honour all of them.
Right of Access
Art. 15Request a copy of all personal data we hold about you at any time.
Right to Rectification
Art. 16Correct any inaccurate or incomplete personal data held on the platform.
Right to Erasure
Art. 17Request deletion of your personal data. Executed within 30 days.
Right to Portability
Art. 20Export your data in machine-readable format (JSON/CSV) on request.
Right to Object
Art. 21Object to processing based on legitimate interest at any time.
Right to Restrict
Art. 18Restrict processing while a complaint or rectification request is active.
To exercise any of these rights, contact us at privacy@ecosphere.no. We respond to all requests within 30 days as required by GDPR.
Frequently asked questions
Common questions from enterprise customers and their compliance teams.
Sub-processor transparency
We are fully transparent about every third-party service that may process your data on our behalf.
| Sub-Processor | Role | Data Processed | Location | Safeguard |
|---|---|---|---|---|
| Microsoft Azure | Cloud infrastructure & storage | All customer data | EU (Norway / West Europe) | ✅ ISO 27001 · SOC 2 Type II · Microsoft DPA |
| Azure OpenAI Service | AI document & image analysis | Uploaded document content | EU (targeted) | ✅ Enterprise agreement · No training on customer data |
| Climatiq | Emissions factor calculations | Activity & spend data (no PII by default) | EU (Germany) | ✅ DPA in place · Data minimisation applied |
Sub-processor list is reviewed and updated with 30 days' advance notice to data controllers when changes occur.
Questions about data protection?
Our data protection team is available to answer security questionnaires, provide documentation, and support compliance due diligence from your legal or procurement team.