Lifetime Legal & Compliance Hub

Transparency as a Service.

At Lifetime Oy, we believe that legal clarity is the foundation of industrial trust. Our "Compliance First" architecture is designed to turn complex EU regulations—such as Fit for 55, the EU AI Act, the Digital Services Act (DSA), the EU Data Act, and GDPR—from liabilities into competitive assets for our clients.

Below you will find our complete legal framework, governing our software, services, and commercial relationships. Each policy carries an explicit effective date, last review, and named escalation channel to simplify vendor-risk assessments.

0. Compliance at a Glance

This overview summarises the key legal and compliance controls for Lifetime Oy (Lifetime Oy, Finland & DWS IQ OÜ, Estonia), DWS IQ 7 Aegis (primary product) and its predecessor DWS IQ 6 (installed base), the Firehorse product line, Lifetime Consulting & Advisory services, and Lifetime Studios services.

---

1. EU AI Act Self-Classification

Lifetime Oy maintains formal documentation of DWS IQ 6's classification under the EU AI Act (Regulation 2024/1689), enforceable from 2 August 2026.

Documented Compliance Elements

Regulatory Timeline

---

2. Digital Sovereignty

Sovereignty is the primary segmentation axis — not the only one. Jurisdiction is the first cut. Industry, price and capability still matter after it. 🛡️ EU-Sovereign by Design

The Commission’s Cloud Sovereignty Framework (v1.2.1) scores offers SEAL-0 … SEAL-4. SEAL is a gate (weakest of eight SOV objectives). Cloud III’s floor was SEAL-2. DWS was not in that tender and does not hold a SEAL certificate. The table is literacy, not a badge.

Indicative DWS depths: Aegis / Sovereign Infra (J1, EU sales) aim at SEAL-2…3 on an EU-owned stack. Connect (C) is non-EU sales (J2/J3) ≈ SEAL-0/1. NVIDIA GN100/DGX keeps SEAL-4 closed.

• For All Customers: Understand your deployment options — EU-sovereign infrastructure is the default; US hyperscalers are an available secondary option (Connect / C).
• Deployment Options (EU-first):
  • Sovereign Private Cloud ⭐ Recommended: On-premise or dedicated infrastructure with customer-managed encryption. Maximum EU sovereignty and customer-controlled data residency.
  • European Cloud ⭐: Hetzner (Helsinki), Scaleway (Paris/Amsterdam/Warsaw), OVHcloud (EU regions) — EU-owned operators, no US-parent CLOUD Act path, GAIA-X aligned
  • US Hyperscalers (secondary option / C): AWS, Google Cloud, Azure — an EU region on a US parent is SEAL-1, not sovereignty. Suitable where EU-owned clouds do not meet performance or tooling requirements.
• Product Defaults: Firehorse local installations preferred for maximum sovereignty. Edge AI on NVIDIA Jetson keeps sensitive data on-premise. Google Cloud Run europe-north1 (Finland) is an EU region on a US parent — residency, not the sovereign cut.

---

3. Privacy & Data Governance

• Data Protection Management (Tietosuojajohtaminen):

  • We run data protection as a managed, risk-based discipline — not a one-off compliance badge. Leadership commitment, a planned governance model, and continuous improvement underpin both effective risk management and a rising level of data protection.
  • Aligned to ISO/IEC 42001 (AI Management System) and ISO/IEC 27001, with DPIA-driven prioritisation so effort follows the highest-impact risks. See the Compliance Hub for the managed-program view.

• ⭐ Privacy Policy & GDPR Statement

  • For Everyone: How we handle data, cookies, and your rights.
  • Key Assurance: We do not use your private industrial data to train our public models. We deploy Private Cloud instances to ensure full data sovereignty.
  • Data Subject Requests: Export, correction, and deletion requests are acknowledged within 2 business days and fulfilled within 30 days.

• ⭐ Data Security Policy

  • For Business Partners: How we protect confidential data with zero-knowledge encryption.
  • Key Features: Proton Mail E2EE, Proton Drive encryption, EU data residency options.
  • Compliance: GDPR, EU AI Act, NIS2, EU Data Act documented.

• ⭐ Data Handling Policy

  • For Team & Partners: Our internal rules for data classification, AI tool use and storage. Available to customers and partners under NDA.
• Data Processing Agreement & SCCs: Our modular DPA aligns with IT2022 EHK terms. View the full DPA or request a signed copy via legal@lifetime.fi.
• Data Protection Contact: Lifetime Oy is not required to appoint a Data Protection Officer (GDPR Article 37) and has not appointed one. Data protection requests: privacy@lifetime.fi. The data protection management program is backed by external data-protection and AI-governance expertise (advisory bench) to ensure independent, risk-based oversight.
• AI Act Compliance: DWS IQ and Firehorse are classified as limited-risk systems with full technical documentation.

---

4. Digital Services & Platform Accountability

• Digital Services Act alignment: Lifetime Oy is not a very large online platform. We provide a single point of contact (Articles 11–12) and state content rules in our terms (Article 14).
• Notice & action channel: Report suspected illegal content or AI misuse via legal@lifetime.fi. We reply within 48 hours.
• NIS2 & incident reporting: 24-hour early warning to Traficom, incident notification within 72 hours, final report within one month (Directive (EU) 2022/2555 Art. 23(4); Finland: Kyberturvallisuuslaki 124/2025). The Commission's amendment proposal COM(2026) 13 (20.01.2026) is still in the legislative procedure; it does not change these duties.

---

5. Commercial Agreements

• ⭐ Agreement & Project Terms

  • For Clients: The master service agreement framework. We generally follow IT2022 terms.
  • Scope: Confidentiality (NDA), IPR transfer, and general liability.

• ⭐ Professional Services Terms

  • For Consulting Clients: Specific terms for advisory, implementation, and "Kickoff" packages.
• Service Levels & Incident Credits: Baseline SLA provides 99.5% monthly uptime for DWS IQ. Enterprise tiers can extend to 99.9% uptime.
• Procurement shortcut: Downloadable compliance summary included in each proposal pack. Request via compliance@lifetime.fi.

---

6. Product Terms of Service

• ⭐ DWS IQ Terms of Service

  • For SaaS Users: Governs the use of the DWS IQ platform.
  • Focus: SLA, uptime, and permissible use of AI agents.
  • Autonomous Guardrails: AI agents cannot trigger safety-critical actions without human validation.

• ⭐ Firehorse Terms of Service

  • For Automation Users: Terms for Firehorse reporting and marketing automation.
  • Marketing Compliance: Unsubscribe, consent, and auditable templates for EU and US outreach.

• ⭐ Lifetime Fleet Terms

  • For Logistics Partners: Terms for physical robotics, drone, and vehicle operations.
  • Regulatory Alignment: EU Machinery Regulation, EASA drone operator requirements.

---

7. Investor Relations

The regulatory notice for investors, the SAFE terms and the risk factors are available to qualified investors in our data room after sign-in. We do not offer securities to the public on this website. Request access or write to invest@lifetime.fi.

---

8. Return & Performance Policy

• ⭐ Return Policy
  • Digital services: SaaS subscriptions may be cancelled within 14 days for a full refund.
  • Physical hardware: 14-day statutory withdrawal right plus 60-day performance guarantee.
  • Professional services: Kickoff deposits refundable until the first milestone workshop.

---

9. Security Research

Independent research and analysis on AI safety, cybersecurity, and enterprise risk management informing our platform security posture and compliance architecture.

• International AI Safety Report 2026 — DWS Field Note New

  • Source: International AI Safety Report 2026 (Yoshua Bengio et al., 100+ experts, 30+ countries)
  • Key Findings: Existing AI safety practices are insufficient. Three risk categories: misuse, malfunction, systemic risks. 60% of advanced economy jobs exposed to AI. Autonomous agent governance urgently needed.
  • DWS Impact: Supports the Article 12 logging design target, Firehorse human-in-the-loop model, and climate-AI convergence positioning.
  • Full Report: internationalaisafetyreport.org

---

10. Security & Trust

Security is not a feature — it is the foundation of every DWS IQ deployment. Our security architecture is designed for EU-regulated industries where agent failures have legal, financial, and safety consequences.

Security Architecture

Three Evidence Layers for D&O Safe Harbor

D&O insurers require documented governance that proves “reasonable measures” were in place before an AI agent acted. The KYA Specification produces three independent layers of evidence, each mapped to a distinct liability question:

1. Identity Attribution. Proves which agent produced the output — not “our AI.” Every agent carries a cryptographic identity bound to its deployment context, which isolates director decisions from agent failures.
2. Fault Attribution. Separates LOGIC_FAULT (agent error) from OPERATOR_FAULT (human misconfiguration) from MANIFEST_FAULT (deployment issue). Demonstrates that the board’s governance framework was adequate even when an individual agent fails.
3. Behavioral Guardrails. Pre-execution controls were active before the agent acted, enforced by the Leash Snap Protocol (design target < 5 ms per decision; no measurement report published yet). This is the evidence a board needs to show it took reasonable measures; whether it limits personal liability depends on national law and the insurer.

Continuous Security Testing

• 15 CI/CD security workflows — automated on every commit (SAST, dependency scanning, secret detection)
• Automated penetration testing — internal pentest suite covering OWASP Top 10 and OWASP LLM Top 10 (auth bypass, CORS, SSRF, prompt injection, MCP tool poisoning, supply chain)
• Weekly dependency audit — npm audit + Bandit/Safety for Python components
• Pre-commit hooks — block credentials, secrets, and PII from entering version control

AI-Specific Security (OWASP LLM Top 10)

• Prompt Injection Defense: All MCP tool responses treated as untrusted input; no auto-installation of community skills
• Sensitive Data Exposure: Agent sandbox isolation prevents cross-tenant data access; KYA session boundaries enforce data separation
• Supply Chain Risk: No auto-install from community registries; all dependencies pinned with lockfiles; SRI hashes on CDN resources
• Agent Autonomy Control: Five autonomy tiers (1–5) with human-in-the-loop required for safety-critical actions; no autonomous actuations without validation

Certifications & Compliance Roadmap

Responsible Disclosure

We welcome security researchers who identify vulnerabilities in our platform. Please report findings responsibly:

• Contact: security@lifetime.fi
• Acknowledgment: Within 48 hours of report
• Fix Timeline: Critical — 48 hours; High — 7 days; Medium — 30 days; Low — next release cycle
• Scope: dws10.com, dws6.com, onelifetime.world, API endpoints, MCP servers
• Out of Scope: Social engineering, physical attacks, denial of service

See our security.txt (RFC 9116) for machine-readable security contact information, and the full Vulnerability Disclosure Policy for scope, guidelines, and what to expect from us.

---

11. Customer Risk Disclosures

Lifetime Oy provides the following disclosures in the interest of full transparency. We encourage prospective customers, deployers, and investors to review these with their own legal and compliance teams before integration.

EU AI Act — Deployer Responsibility

Our limited-risk self-classification applies to DWS IQ 6 as designed and deployed by Lifetime Oy. DWS IQ 7 Aegis is classified per deployment against Annex III before go-live; the self-classification above covers the DWS IQ platform as described. Under Article 26 of the EU AI Act, deployers bear independent responsibility for their own use-case risk assessment. If you integrate DWS IQ 6 into operations that may constitute safety-critical infrastructure under Annex III — for example, energy grid control, transport critical infrastructure, or employment-decision systems — a higher-risk classification may apply to your specific deployment, regardless of our provider-level classification.

We have designed DWS IQ 6 with preparatory controls (human oversight, audit trails, risk management tiers) that ease any such reclassification. Contact compliance@lifetime.fi to discuss your specific integration scenario before go-live.

Product Maturity & Early Commercial Stage

DWS IQ 6 v1.0 launched on 23 February 2026 and is in an active pilot and early commercial phase. Its successor, DWS IQ 7 Aegis, is the primary product; general availability is planned for Q1 2027, after the first pilot acceptance record — a plan, not a committed date. Real-world regulatory enforcement of AI Act claims across EU markets will mature after the August 2026 deadline. Enterprise customers should allow for a standard evaluation period. Our SLA (99.5% baseline uptime) and return policy protect your deployment commitment during this phase.

Third-Party Audit Status

As a limited-risk AI system, no notified-body review or CE marking is required or planned. ISO 27001 certification is planned — no date confirmed. Internal automated penetration testing (OWASP Top 10 + LLM Top 10) was established Q1 2026 and runs continuously. An annual external third-party pentest is planned — no date confirmed (report will be available under NDA upon request). No independent AI conformity assessment has been conducted to date — this is consistent with the limited-risk regime.

Regulatory Interpretation Risk

EU AI Act interpretation — particularly for Annex III point 2 (critical infrastructure) and cross-sector industrial AI — is still evolving as the EU AI Office publishes implementation guidance. Lifetime Oy monitors EU AI Office communications and updates its compliance position accordingly. Our governance framework is designed to accommodate regulatory clarifications without architectural rework.

---

12. Contact & Escalation

---

13. Board Governance & D&O Safe Harbor

KYA (Know Your Agent) is the governance framework that produces the evidence boards, courts and insurers ask for about autonomous AI agents. It does not by itself make a deployment EU AI Act compliant. It is designed for boards and directors who approve agentic AI deployments in EU-regulated industries.

KYA Framework: Two Standards

• KYA-S (Security Standard). Agent identity, behavioural guardrails, pre-execution controls. Proves which agent did what and that controls were active before it acted. Enforcement latency design target < 5 ms per decision. Note: KYA-S1 is distinct from EU AI Act compliance. The current reference implementation keeps proactive outbound actions limited to the named advisor-phase agents (compliance, customer-sat, sitesense), with other agents in silent_pilot by default.
• KYA-O (Optimisation Standard). Agent Trust Score (ATS 0–100), autoresearch governance, reliability metrics across production deployments.

Full specification: KYA Specification v1.5.

D&O Insurance Impact

---

14. EU-Regulated Industries Coverage

DWS IQ 6 is designed for autonomous-agent governance across the industries most exposed to Fit for 55, CBAM, ETS, CSRD, and the EU AI Act. Coverage is organised in three regulatory-exposure tiers: