Spurvik Book a DPO walkthrough

Executive brief, rev. 2026.10Not legal advice

Prove what your AI did without keeping what your users said.

Three AI Act duties in pictures, the cost of a breach, and a one-click CTO handoff.

2 Aug 2026Art. 50 AI notices apply
2 Dec 2027Art. 12 logs, Art. 14 oversight (Annex III)
€15M or 3%Art. 99(4) ceiling, whichever is higher
0 bytesof raw prompt text kept by Spurvik

Three duties, three dates

Support chat You’re chatting with an AI system Can I lower my rate? AI Here are your options
Art. 50

Tell people they’re talking to an AI.

A clear notice, at the latest at the first interaction.

Applies since 2 Aug 2026Spurvik: notice text on every call

Art. 50(2) marking: 2 Dec 2026 for existing systems.

Event 1 Event 2 Event 3 kept ≥ 6 months · no raw text inside
Art. 12

Keep tamper-evident logs without hoarding personal data.

Automatic event records, kept at least six months.

From 2 Dec 2027, Annex III high-riskSpurvik: sealed record per event
Named approver AI agent €40,000 Bank Held for sign-off Approved, then executed
Art. 14

A person signs off before agents pay or delete.

Oversight that lets a person step in or stop.

From 2 Dec 2027, Annex III high-riskSpurvik: holds until approved

As amended by Reg. (EU) 2026/1744, the Digital Omnibus.

How personal data disappears before anything leaves your app

Loan request CPR 120485-1234 anna.berg@example.dk

1Raw documentYour app holds the text, as it does today.

HMAC-SHA256 key stays with you raw text discarded

2Cryptographic sealThe SDK seals it with your key, then discards the raw text.

Frankfurt · fra1 64-character fingerprint

3Fingerprint in FrankfurtOnly the fingerprint is kept: in your EU store today, in Spurvik fra1 once hosting launches.

Zero-PII means no raw personal data is persisted. Fingerprints remain pseudonymised data under GDPR Art. 4(5) while your key exists.

What a breach could cost, next to what Spurvik costs

€100M
Company size

SME: under 250 staff and turnover up to €50M.

Spurvik plan
Statutory maximum, Art. 99(4)

Spurvik plan, per year
statutory maximum against one year of Spurvik

A ceiling, not an expected fine; Art. 99(7) weighs the measures you had in place. Log scale.

Why OpenAI’s built-in logs aren’t enough on their own

Model vendor own logs “CPR 1204… “Pay Jens… grades its own homework

Model vendor’s logs Self-attested

  • Kept by the vendor being judged
  • Raw prompt and reply text by default
  • One vendor’s models only
  • EU data residency available
OpenAI Anthropic Local model one record independent of any model vendor

Spurvik record Independent

  • Held apart from every model vendor
  • Sealed fingerprints only; your key never leaves you
  • OpenAI, Anthropic and local models in one record
  • Nothing readable to hand over, whoever asks

Our hosts (Vercel, Neon on AWS) have US parents; we claim no CLOUD Act immunity, only that the record holds nothing readable. Public documentation, October 2026.

Send the implementation mandate to your CTO

Add your company name. The message is written in this tab and goes nowhere until you send it.

Email it

PreviewPlain text

              

Commercial terms

List prices, excl. VAT, B2B only.

Team

€249/mo

€2,490/yr, up to 50,000 events/mo

90-day pilot €522.90

Scale

€1,490/mo

€14,900/yr, up to 1,000,000 events/mo

90-day pilot €3,129

Enterprise

from €30,000/yr

Custom volume and a dedicated EU region

Pilots are credited on conversion. The Founding 10 design partner offer closes 2 December 2026.

Book a 45-minute walkthrough

Questions DPOs ask

Is the fingerprint personal data?

Treat it as pseudonymised data. Without your key nobody can link it to a person; with it and the original, you can prove a match.

Who holds the key?

You do, in your environment or KMS. It never travels with events.

Can Spurvik read our users’ prompts?

No. Prompts go only to your model provider, with emails, IBANs and CPR numbers redacted first.

Does Spurvik make us compliant?

No tool can. Spurvik supplies measures and evidence that support Art. 50, 12 and 14; classification, your DPIA and any conformity assessment stay with you.