DWS IQ · Lifetime Oy
Trusted scale, security by design.
Every claim on this page carries its evidence status. Where we have a gap, we name it before you find it. Your procurement and security teams can check each line against a document, or ask us for it.
One rule: if we cannot show the evidence when we make a claim, we do not make the claim. These are the statuses we use internally, published as they are.
| Claim | Status | What you can check |
|---|---|---|
| Contracting entity and governing law | Shown | Lifetime Oy, Finland, Business ID 0772407-9 (Finnish Trade Register). Finnish law; Espoo District Court. |
| Data processing terms (GDPR Art. 28) | Shown | Public Data Processing Agreement v1.2 and sub-processor list per product tier, with parent-company jurisdiction, change log and 30-day change notice. |
| Privacy notice and data subject requests | Shown | Privacy Policy. Requests are acknowledged within 2 business days and completed within 30 days. Gap: the legal basis per purpose and the retention periods are not yet stated in the notice. |
| EU-only data location | Partial | The Aegis tier is designed with no US-incorporated provider in the data path. Gap: today's platform runs on providers with US parent companies (EU regions) and uses two US AI providers under Standard Contractual Clauses. See Where your data lives. |
| EU AI Act position | Partial | Self-assessment: the DWS IQ platform, as designed, is not a high-risk AI system. The Article 50 transparency duties apply, and AI-created public text carries a notice. DWS IQ 7 Aegis is classified per deployment before go-live. Gap: no independent assessment. Your own use can change the classification (Art. 26 deployer duties); we review it with you before go-live. |
| Decision logging for audit (Art. 12 model) | Partial | An append-only audit log built to the Article 12 model is in place. The Aegis agent is built to write a record for every model call; log retention is 7 years. High-risk obligations apply from 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I) under Regulation (EU) 2026/1744. Gap: not every agent writes to the log yet; extending it to all agents is in progress. |
| PiTuKri (Finnish public-sector cloud criteria) | Partial | Self-assessment against PiTuKri v1.1: 42 of 52 criteria met (81 %). Gap: 7 criteria not met, including a formal personnel-security process. No independent audit has been done. |
| ISO/IEC 27001 | Target | Planned. No date confirmed. Gap assessment in progress. |
| SOC 2 Type II | Target | Planned. No date confirmed. |
| ISO/IEC 42001 (AI management system) | Target | Preparing. No date confirmed. |
| Security testing | Partial | Static analysis, dependency scanning and secret detection run on every code change. Internal tests cover OWASP Top 10 and OWASP LLM Top 10. Gap: the 2026 external penetration test has not been done yet. |
| Encryption | Partial | TLS on all public endpoints. Encryption at rest is provided by the hosting provider. Gap: key management details per tier are available under NDA, not published. |
| Agent stop ("leash snap") under 5 ms | Target | A design target. Gap: no measurement report is published. |
| Per-agent sandbox isolation | Partial | The architecture is described in the KYA specification. Gap: runtime evidence is shown on request, not published. |
| KYA-S1 agent attestation specification | Shown | Public draft, open for comment until 4 Nov 2026. It is a specification, not a standard. DWS issues no attestation tier to itself. |
| Incident reporting | Partial | Our incident process follows the NIS2 timelines: early warning within 24 hours, incident report within 72 hours. Gap: the process document is shared under NDA, not published. |
| Export control (EU dual-use, Reg. 2021/821) | Not claimed | No classification evidence is published. A dual-use notice is being prepared for defence and government buyers. |
| ITAR / EAR coverage | Not claimed | We make no claim. |
Your contract records the product tier. Our duties as data processor are the same in every tier. What changes is the data location, the providers and the exposure to non-EU law.
| Tier | Hosting and data location | Non-EU law exposure |
|---|---|---|
| DWS IQ 7 Aegis | EU only. Hetzner (Helsinki) and Aiven managed PostgreSQL in an EU-owned region (UpCloud, Finland). No US-incorporated provider in the data path. | None by design. Aiven has non-EU investors; we disclose this and rely on Aiven's own key management and EU contracts. |
| DWS IQ Sovereign Infra | EU only. Scaleway EU cloud. Optional EU-region services from US-parent vendors under Standard Contractual Clauses. | None for stored data. Contractual exposure remains where a US-parent vendor delivers in the EU. |
| DWS IQ Connect | Region chosen by you (EU, US, APAC, MENA) on AWS, Azure, Google Cloud or NVIDIA. | Standard for the chosen region. US law, including the CLOUD Act, can apply. |
A provider with a US parent company can be subject to the US CLOUD Act even when the data sits in an EU region. We show the parent jurisdiction and do not call this sovereignty.
| Provider | Purpose | Parent jurisdiction | Data location |
|---|---|---|---|
| Supabase Inc. | Database, authentication | USA | EU (Finland / Germany) |
| Google Cloud (Google LLC) | Compute, AI APIs | USA | EU (Finland) |
| Cloudflare Inc. | CDN, edge, DDoS protection | USA | EU edge nodes |
| Temporal Technologies Inc. | Workflow orchestration | USA | EU |
| Anthropic PBC | Language model (pseudonymised data) | USA | USA, under SCC |
| Groq Inc. | AI inference (pseudonymised data) | USA | USA, under SCC |
| Shufti Pro Limited | Identity verification (biometric data) | United Kingdom | EU only, confirmed in writing |
The binding list is the sub-processor list (DPA Annex A). We notify customers 30 days before any change. Customer data is not used to train AI models without your written consent (DPA 2.6.2).
Public documents are open to everyone. Your security review can get the deeper material under NDA, and investors get it in the data room.
Read now, no sign-in.
For your security and procurement review.
Data room, after sign-in.
Investor sign-in →
No access yet? Write to
invest@lifetime.fi.
Email security@lifetime.fi with the details. We acknowledge within 48 hours. Target fix times: critical 48 hours, high 7 days, medium 30 days, low in the next release.
Read the full Vulnerability Disclosure Policy.
In scope: dws10.com, dws6.com, onelifetime.world, API endpoints and MCP servers. Out of scope: social engineering, physical attacks and denial of service.
Machine-readable contact: /.well-known/security.txt (RFC 9116).
Two named people answer for this page.
This page is a summary. The binding terms are in the Data Processing Agreement, the terms of service and your contract. Lifetime Oy · Business ID 0772407-9 · VAT FI07724079 · Laidunmaanraitti 2 A 25, 02330 Espoo, Finland. Last reviewed 13 October 2026.