Built so a compliance officer can nod.
How Eidoscore is hosted and operated, in short. A fuller security note is available on request.
EU-hosted
Infrastructure in the European Union, GDPR-aligned by default.
Public sources only
A documented lawful basis per collector. Never private or closed groups.
Retention by layer
Raw content, derived insights and reports each have their own rule.
Audit trail
Every alert, review decision and action on the record.
Access control
Single sign-on, two-step verification, admin and reviewer roles.
Human approval
Nothing is published or sent externally without a named person approving it.
Hosting and residency
Collection, storage, classification and reporting run on systems we operate inside the European Union, so collected content, derived insights and reports stay there. The exceptions are the language models listed under subprocessors below.
- Provider and region named in the security note and in your contract
- No move to another region without telling you first
- A workspace per client, with roles and retention set per workspace
What we collect and how long we keep it
Retention is documented per workspace and agreed in your contract. The layers are kept apart so each can have its own rule.
Raw content
Publicly accessible content only, kept for a limited period.
Original and translation
Each item is kept as written, with a translation, so a reviewer judges the source itself.
Derived insights
Narratives, scores and flags are kept longer for trends.
Reports
Briefs are fixed once generated and kept as agreed.
Political data and the GDPR
Content revealing political opinions is special-category data under the GDPR. We say GDPR-aligned deliberately: compliance is a property of a deployment and its paperwork, not a badge.
- Topics, narratives and communities by default, not individuals
- A Data Protection Impact Assessment before any scaled monitoring of political content
- A walk-through of the architecture for your DPO, on request
Subprocessors
The list is short, and we will tell you what is on it. Before any contract begins we say which models would process your data, where they run, and what the alternatives are.
- Hosting and storage inside the EU, on infrastructure we operate
- Classification uses large language models, named with their role and location in the security note
- Client content and live political data do not flow through a non-EU-resident model until the assessment and residency requirements are met
Every decision on the record
Every collection run, classification, alert, review decision and publishing event is written to the workspace audit log. Entries cannot be edited or deleted, and the log can be exported for your own records.
Want the full security note?
A written note covering data handling, access, retention and incident response, provided on request. We will also walk your DPO through the architecture.