Legal Hub
Spoki's contracts, policies and legally required information in one place, with versions and history. Spoki is operated by NextAI Srl.
Security and AI transparency
Summary of the technical and organisational measures in Annex 2 of the DPA. The DPA is the binding text.
48 h
Incident management
NextAI informs the customer without undue delay and in any case within 48 hours of becoming aware of a personal data breach, also in stages (DPA art. 11.1).
Security measures
- Encryption in transit with TLS 1.2/1.3 and at rest with AES-256 (AWS KMS).
- Mandatory multi-factor authentication for administrative access.
- Multi-tenant isolation between customers.
- Penetration tests every six months.
- Backups on Amazon S3 and Glacier with defined RTO and RPO.
Artificial intelligence
- Customer data is not used to train, fine-tune or evaluate AI models, except models dedicated to a customer and requested in writing (DPA art. 6.9).
- Inference outside the EEA runs under terms that exclude training and, where possible, retention (DPA art. 9.4).
- People who interact with an AI agent must be told they are talking to an AI system (Art. 50 AI Act).
Certifications
Certification work is in progress. We will publish certifications here only once they are obtained.
Questions about a document?
Write to us and include the document name and version.