INTEGRATED CONTROLS
Security throughout the platform.
Access, data sources, models, and events are governed based on business requirements and the sensitivity of the information.
Last updated October 6, 2026
Processing in Sweden
Operation and storage in Sweden, with the option of operation in your own environment.
No training on your data
Your data is not used to train public AI models.
Role-based access
Access per data source, linked to the organization's login.
Event log
Usage, access, and sources are logged and can be audited.
COMPLIANCE
Standards and regulations
Here you can see what Violet contributes within each area and what documentation we provide ahead of your own assessment.
GxP and GAMP 5
Validated for GxP use in accordance with GAMP 5.
The Cybersecurity Act (NIS2)
For operations covered by the Cybersecurity Act, we provide supplier and security documentation as well as incident procedures to support your risk management and supply chain security.
DORA
Contractual terms, information for your information register, and an exit plan for your third-party risk management.
The AI Act
Documentation describing Violet's role and what applies to you as a provider of AI systems.
ISO/IEC 27001
Systematic information security work based on the requirements of ISO 27001.
GDPR
Data processing agreements in accordance with Article 28 are signed with each customer, along with a list of sub-processors.
DATA FLOW
From data source to answer, within the right boundaries
Violet connects to the business's data sources with defined permissions. Access, processing, and storage are adapted according to the information's classification and the organization's requirements.
CONTROLS
Controls in the platform
Built-in controls govern who gets access, which data sources are used, and how information is protected and monitored.
Access control
Control access based on users, roles, and the organization's permission structure.
Identity and login
Connect your organization's identity provider for centralized management of users and access.
Encryption
Protect information during transmission and storage using established encryption methods.
Logging and auditing
Follow relevant events and usage through logs and audit trails.
Restricted data sources
Determine which data sources each solution, assistant, or user group is allowed to use.
Controlled model access
Control which models are allowed to process different types of information and under what conditions.
OPERATIONS AND DATA HOSTING
Operations according to business requirements
The operating environment and choice of model are adapted according to the classification of the information, existing infrastructure, and the organization's risk assessment.
Swedish cloud environment
Processing and storage in Swedish infrastructure with defined geographical boundaries.
Isolated environment
Separate environment for operations requiring a higher degree of isolation and control.
Local installation
Models and data can be kept within the organization's own infrastructure when requirements justify it.
INCIDENTS
When something happens
In the event of a security incident, it needs to be clear who does what. This is how the responsibility is divided between us and you.
We inform you
If an incident affects your information, we will notify you without undue delay, providing the information we have regarding what occurred.
You assess and report
With our information, you can assess the incident and report to, for example, the IMY, NCSC, or the Swedish Financial Supervisory Authority (Finansinspektionen), if your regulations require it.
The agreement governs the details
How and when we inform is regulated in the agreement and in the data processing agreement. It can be adapted to your requirements.
FAQ
Your questions.
Where is our data stored and processed?
Processing and storage take place in Swedish infrastructure. Which operating environment is used is determined together with you based on the classification of the information: Swedish cloud environment, isolated environment, or installation in your own infrastructure. Your data is not used to train public AI models. If you also choose to use general models for tasks without sensitive information, it is clearly stated which information may be handled there.
What does the CLOUD Act mean for us?
The CLOUD Act allows US authorities to request data from US providers, even when the data is stored in Europe. Violet is a Swedish company and your solution is hosted in Swedish infrastructure. The sub-contractors included in your specific solution are specified before deployment, so that you can factor this into your own risk assessment.
Can we run the models locally?
Yes. Models can be run within your own infrastructure, which means that both data and inference remain there. Which models are suitable depends on the task and what hardware you have access to. We will go through the options in the analysis phase.
How does Violet support our work with NIS2 and DORA?
NIS2 and DORA place demands on your organization. The platform delivers the parts you need to be able to present in that work: documented access control, logging of events, clarity regarding the supply chain, and supporting data for your risk management. The responsibility for compliance remains with you, and we assist with the documentation.
What applies to us according to the EU's AI Act?
The applicable requirements depend on how you use AI, not on the platform itself. The transparency requirements set out in Article 50 apply from 2 August 2026, subject to a transition period for some of them. Under the amending regulation (EU) 2026/1744 of July 2026, the requirements for high-risk systems listed in Annex III have been postponed from 2 August 2026 to 2 December 2027. For AI that is a safety component of a product, they apply from 2 August 2028. We help you determine where your use cases fall and identify the documentation you need.
Read more: How the AI Act, NIS2, DORA, and GDPR affect your AI solution
What is Violet's role according to GDPR?
Violet is the data processor for the processing that takes place in the platform. You are the data controller and decide which information may be used. A data processing agreement, a list of sub-processors, and a description of the processing are developed as part of the agreement.
What is logged, and how long is the information stored?
Calls and relevant events are logged so that usage can be followed up afterwards. The logs can be exported for internal follow-up or external review. How long data and logs are saved is configured according to your requirements for deletion.
![](data:image/svg+xml,<svg display="block" id="1638568010" role="presentation" viewBox="0 0 58 23" xmlns="http://www.w3.org/2000/svg"><g d="M 14.647 0.211 L 16.763 0.211 L 16.763 11.789 L 14.647 11.789 Z M 31.953 0.211 L 34.069 0.211 L 34.069 9.649 L 38.599 9.649 L 38.599 11.789 L 31.953 11.789 L 31.953 0.211 Z M 40.373 0.251 L 47.48 0.251 L 47.48 2.391 L 42.489 2.391 L 42.489 4.883 L 46.952 4.883 L 46.952 6.901 L 42.489 6.901 L 42.489 9.689 L 47.52 9.689 L 47.52 11.829 L 40.372 11.829 L 40.372 0.251 Z M 52.561 2.351 L 49.254 2.351 L 49.254 0.211 L 58 0.211 L 58 2.351 L 54.677 2.351 L 54.677 11.789 L 52.561 11.789 Z M 24.342 0 C 27.32 0 29.86 2.684 29.86 6 C 29.86 9.316 27.327 12 24.342 12 C 21.358 12 18.857 9.316 18.857 6 C 18.857 2.684 21.364 0 24.342 0 Z M 24.358 2.193 C 22.446 2.193 21.035 3.772 21.035 6 C 21.035 8.228 22.446 9.806 24.358 9.806 C 26.27 9.806 27.681 8.227 27.681 6 C 27.681 3.773 26.255 2.193 24.358 2.193 Z M 2.45 0.211 L 0 0.211 L 5.927 11.582 C 6.127 11.966 6.622 11.964 6.821 11.579 L 7.594 10.081 Z M 6.503 0.211 L 4.899 0.211 L 8.812 7.719 L 10.031 5.357 L 7.775 1.029 C 7.511 0.522 7.026 0.211 6.503 0.211 Z M 9.896 1.498 C 9.896 0.671 10.495 0 11.234 0 C 11.973 0 12.572 0.671 12.572 1.498 C 12.572 2.325 11.973 2.995 11.234 2.995 C 10.495 2.995 9.896 2.325 9.896 1.498 Z" fill="transparent" height="12px" id="Izr1HXd1s" transform="translate(0 6)" width="58px"><path d="M 14.647 0.211 L 16.763 0.211 L 16.763 11.789 L 14.647 11.789 Z M 31.953 0.211 L 34.069 0.211 L 34.069 9.649 L 38.599 9.649 L 38.599 11.789 L 31.953 11.789 L 31.953 0.211 Z M 40.373 0.251 L 47.48 0.251 L 47.48 2.391 L 42.489 2.391 L 42.489 4.883 L 46.952 4.883 L 46.952 6.901 L 42.489 6.901 L 42.489 9.689 L 47.52 9.689 L 47.52 11.829 L 40.372 11.829 L 40.372 0.251 Z M 52.561 2.351 L 49.254 2.351 L 49.254 0.211 L 58 0.211 L 58 2.351 L 54.677 2.351 L 54.677 11.789 L 52.561 11.789 Z M 24.342 0 C 27.32 0 29.86 2.684 29.86 6 C 29.86 9.316 27.327 12 24.342 12 C 21.358 12 18.857 9.316 18.857 6 C 18.857 2.684 21.364 0 24.342 0 Z M 24.358 2.193 C 22.446 2.193 21.035 3.772 21.035 6 C 21.035 8.228 22.446 9.806 24.358 9.806 C 26.27 9.806 27.681 8.227 27.681 6 C 27.681 3.773 26.255 2.193 24.358 2.193 Z M 2.45 0.211 L 0 0.211 L 5.927 11.582 C 6.127 11.966 6.622 11.964 6.821 11.579 L 7.594 10.081 Z M 6.503 0.211 L 4.899 0.211 L 8.812 7.719 L 10.031 5.357 L 7.775 1.029 C 7.511 0.522 7.026 0.211 6.503 0.211 Z" fill="rgb(255, 255, 255)" height="12px" id="a1IMVZrIK" width="58px"/><path d="M 0 1.498 C 0 0.671 0.599 0 1.338 0 C 2.077 0 2.676 0.671 2.676 1.498 C 2.676 2.325 2.077 2.995 1.338 2.995 C 0.599 2.995 0 2.325 0 1.498 Z" fill="rgb(255, 255, 255)" height="2.995343586849174px" id="d4Ta5Wqiw" transform="translate(9.896 0)" width="2.6762132060461354px"/></g></svg>)