Website security and application scope
The EUAIC website uses HTTPS, browser security headers and a verified-email enquiry process. Website controls should be distinguished from the security of a contracted governance application. Hosting location, user roles, integrations, retention and recovery arrangements depend on that application’s agreed scope.
No certification, audit report or particular datacentre location is asserted by this website statement. Request the evidence and service-specific controls needed for your procurement review.
Security approach
AI compliance information, enquiry records and customer discussions can be commercially sensitive. EUAIC’s website and service communications should be supported by proportionate safeguards, access control, secure configuration, maintenance and monitoring.
Technical safeguards
Expected safeguards may include HTTPS, secure hosting, least-privilege access, patching, backup discipline, logging, malware protection, firewall controls, careful deployment practice and review of third-party services used by the website.
Operational safeguards
Security also depends on human behaviour: access should be limited to authorised personnel, sensitive information should be handled carefully, incidents should be escalated promptly and changes should be reviewed before deployment.
Limitations
No website or system can be guaranteed absolutely secure. This statement explains the intended security posture and does not create a warranty, certification or independent assurance report.
Reporting concerns
Security concerns should be reported privately with affected URL, description, steps to reproduce, time observed and evidence. Reporters must not access data, disrupt systems or publish details before responsible review.
Evidence and governance sensitivity
AI compliance records can include vendor evidence, internal system descriptions, risk decisions, technical documentation references and oversight notes. Even when not highly sensitive, such records should be treated as business information requiring appropriate care.
Incident readiness
Security readiness should include a practical process for identifying, escalating, investigating and documenting suspected incidents. Serious issues may require customer communication, legal review, supplier engagement and post-incident improvement.
Customer responsibilities
Customers should apply their own security measures, including access control, staff training, secure configuration, careful data entry, approved user management and review of downloaded evidence or exported records.