How we handle data and obligations
Everything below is a statement you can hold us to. Where an obligation is only partly met, it says so.
Legal entity
- Entity
- AM Solutions AB
- Org.nr
- 559584-8044
- Registered
- Göteborg, Sverige
- Tax
- Godkänd för F-skatt
Where data is processed
Application data, stored content and generated assets are processed and stored in the EU.
| Category | Location |
|---|---|
| Application hosting and compute | EU |
| Databases and vector storage | EU |
| Object storage for generated assets | EU |
| AI models (analysis and search) | EU |
A model outside the EU is used only if you ask for it in writing; the transfer then relies on Standard Contractual Clauses.
Our public website and its contact form run on a global network. This does not apply to client data in the systems we build.
Subprocessors
We act as processor for client data; the client is the controller. Under Article 28(2) GDPR you are entitled to know who processes data on our behalf and to object to a change.
- We notify clients before adding or replacing a subprocessor.
- Each subprocessor is bound by terms no less protective than our own.
GDPR
- Data processing agreement available on request, with Article 28 terms.
- Data subject requests forwarded to the controller without undue delay, with assistance in responding.
- Data retained only for the term of the engagement; returned or deleted on termination at the client's choice.
- Client data stays in the EU, including AI processing.
EU AI Act
Article 50(2) of Regulation (EU) 2024/1689 requires providers of systems generating synthetic media to mark outputs in a machine-readable format. It has applied since 2 August 2026.
Under the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026), the compliance deadline for high-risk standalone systems (Annex III) moved from 2 August 2026 to 2 December 2027, and for AI embedded in regulated products (Annex I) to 2 August 2028. Article 50 transparency was not affected by this change.
- We do not build systems classified as high risk under Annex III.
- Implementation, and its limits, are documented at Article 50 provenance.
Security
- Passwords and access keys are stored securely, never inside the software itself.
- Your data is encrypted, both when it is sent and when it is stored.
- People and systems get only the access they need, and access is withdrawn when someone leaves or a supplier changes.
AI-specific commitments
- The AI models we use for client data run within the EU.
- On request, AI processing can be kept entirely within Sweden.
- Client data is not used to train models.
- Generative systems are evaluated before deployment, not only at build time.
- Published output passes human review; nothing publishes unattended without it.
Accessibility
Pages are built to WCAG 2.1 AA and EN 301 549.
Insurance
Professional liability insurance (ansvarsförsäkring) in force.
Requesting documents
DPA, subprocessor list and security details: [email protected].
This page describes our own posture. It is not legal advice, and it does not replace the terms of a signed agreement.