Planning an AI implementation or a cloud migration while meeting data security and regulatory requirements? We identify the requirements that apply to the project from the start, then translate them into the solution's architecture, configuration, documentation, and maintenance.
Laws, regulations, and technologies change quickly. We therefore review requirements not only before launch but also when the solution, vendor, or method of data processing changes significantly.
We start with the solution's purpose, the types of data involved, and how the data will be used. We determine whether the project includes personal, confidential, or sensitive data, define each party's role, and identify the GDPR, EU AI Act, Data Act, NIS2, DORA, and industry-specific requirements that must be addressed.
Experience from 1,100+ implementations across industries enables us to anticipate questions commonly raised by IT, security, legal, procurement, and compliance teams.
Based on the requirements, we define the environment architecture, integrations, and access rules. We also define retention, backups, and accountability. We prepare documentation for IT, security, procurement, and compliance teams, then maintain the solution as technologies and regulations change after launch.
We work with the client's legal or compliance team to translate its interpretation of the requirements into a technology solution. We do not provide legal advice. We define roles and required evidence, then incorporate them into the architecture, configuration, documentation, and maintenance.
We define the parties' roles, the scope and purpose of personal data processing, and requirements for access, retention, deletion, and processing by third parties. We translate arrangements agreed with the client's lawyer or Data Protection Officer into the solution's architecture, configuration, integrations, and documentation.
We plan data access, export, interoperability, and vendor switching. For the specific product and delivery model, we define formats, interfaces, responsibility for migration, and the service termination process.
We design secure data sharing and reuse, addressing permissions, access controls, and exchange terms. We design technical solutions that reflect the organization's role and the arrangements made by its legal and compliance teams.
We document the system's intended purpose, participant roles, and application risk, then design access, activity logging, documentation, and an approval stage. AI recommends or prepares materials; a person approves them. We do not train LLM or OCR models—we select and configure existing ones.
We incorporate risk management, access, integration and supply-chain security, event logging, incident response, backups, recovery, and business continuity into the project. We translate the client's role, sector, and adopted interpretation of the requirements into technical solutions.
The CRA establishes cybersecurity requirements for products with digital elements, including vulnerability handling and security updates. As the developer of AMODIT, KSeF Connector, and DataFlow, we run these processes for our products and translate clients' software vendor requirements into technical criteria, documentation, and maintenance.
In financial-sector projects, we translate digital operational resilience requirements into the solution and ICT services: accountability, monitoring, incident response, testing, recovery, documentation, and terms of cooperation with technology providers. We work with the client's legal, security, and compliance teams.
We prepare companies operating in Poland for mandatory structured e-invoicing, from the process and permissions to integrating an ERP or accounting system with KSeF (Poland's National e-Invoicing System). KSeF Connector handles communication, statuses, and errors, while we design the integration for the client's environment.
We launch a secure reporting channel and translate the approved procedure into access controls, confidential communication, attachment protection, and case handling. Explore our whistleblower protection service, the AMODIT module, and the custom reporting platform.
For pharmaceutical and healthcare clients, we perform computer system validation work in line with project-specific requirements such as EU GMP Annex 11 or 21 CFR Part 11. We prepare documentation, change controls, permissions, and an audit trail; this does not mean that Astrafox certifies the system or organization.
We organize the path from source data through integration, quality control, and calculations to the sustainability report. The client and its advisors define the data and disclosures, while we implement the data layer and ESG reporting.
We prepare answers for the specific service, architecture, and maintenance model so that IT, security, procurement, and compliance teams work from the same set of facts.
Does the certificate cover the service being purchased, and what is its exact scope?
Which environments, accounts, and permissions are required, and when will access be revoked?
How should the questionnaire be submitted, and which documents are available for the specific scope?
Which model, provider, region, and processing terms apply to data used by AI?
What will the organization retain when the engagement ends: data, configuration, documentation, and knowledge?
How are accountability, maintenance, and response terms divided?
As a data controller, software developer, and IT service provider, we meet the legal and security requirements that apply to us. Astrafox Sp. z o.o. holds ISO/IEC 27001:2022 certificate no. 4802510 for “Software development and implementation,” valid through December 19, 2027.
Open the PDF certificate →
Privacy Policy, GDPR information clauses, and Cookie Policy. For data protection matters, contact our DPO at iod@astrafox.pl.
Our arrangements cover personal, confidential, and sensitive data and the entire engagement lifecycle: from preparing environments and granting access through revocation, data return, and service termination.
We define the purpose, data categories, region, retention, deletion, and any processing by third parties.
We define accounts, permissions, authorized personnel, activity logging, and access revocation.
Before launch, we verify the selected service's region, retention, data use, and terms.
We deliver DataFlow in the client's infrastructure or in Astrafox hosting. The data warehouse remains on the client's side, while flow definitions and their history remain in the client's repository. The integration and AI assistant configuration determine which information is transferred to external services.
Explore DataFlow →Specify the service and the scope of the questions without including employee or client data. We will identify which information is public, which depends on the solution, and which requires a confidential channel. We use your organization's security questionnaire or requirements list.
Send procurement requirementsBefore signing the agreement, we define responsibility for the environment and backups, the support scope, and how documentation, configuration, and data will be transferred.
Yes. ISO/IEC 27001:2022 certificate no. 4802510 is valid through December 19, 2027, and covers “Software development and implementation.”
We run AI models on Azure, Google Cloud (Vertex AI), and AWS in European Union regions. We retain full control over where data is processed, and the models are not trained on client data. This ensures compliance with the GDPR and the EU AI Act. We confirm the region and architecture before launch.
Once the service and the stage of the discussion are identified, we define which documents are public and which we share through a confidential channel.
No. We work with the client's lawyer or compliance team and translate the agreed requirements into the solution's architecture, configuration, documentation, and maintenance.
Describe the planned implementation, data types, and list of questions. Do not include confidential documents or third-party personal data in the description field.