# TOMs ALAI AI Services v1

# Technical and Organizational Measures (TOMs)

## ALAI Holding AS — AI Services

**Version:** 1.0 | **Date:** 2026-05-01 | **GDPR Reference:** Article 32

---

## Overview

This document describes the technical and organizational measures (TOMs) implemented by **ALAI Holding AS** to ensure the security of personal data processed on behalf of clients in connection with AI Services.

ALAI acts as a **Data Processor** when delivering AI services (AI audits, AI development, AI agent orchestration) to clients. This document satisfies GDPR Article 28(3)(c) requirement to demonstrate appropriate security measures.

## Technical Measures

### 2.1 Encryption

<table id="bkmrk-measureimplementatio"><thead><tr><th>Measure</th><th>Implementation</th><th>Purpose</th></tr></thead><tbody><tr><td>**Data in Transit**</td><td>TLS 1.3 for all HTTP connections; SSH for server access</td><td>Protect data during transmission</td></tr><tr><td>**Data at Rest**</td><td>AES-256 encryption for PostgreSQL databases, file storage, and backups</td><td>Prevent unauthorized access to stored data</td></tr><tr><td>**API Keys and Secrets**</td><td>Stored in Bitwarden (encrypted vault); environment variables in production; never committed to git</td><td>Protect credentials</td></tr><tr><td>**Email**</td><td>TLS for SMTP/IMAP; PGP available for sensitive communications</td><td>Secure email in transit</td></tr></tbody></table>

**Implementation Details:**

- All client-facing web services enforce HTTPS via Cloudflare SSL
- Database connections use SSL/TLS (Azure PostgreSQL enforces encrypted connections)
- Backups encrypted at rest using Azure Storage encryption (Microsoft-managed keys)

### 2.2 Pseudonymization

<table id="bkmrk-measureimplementatio-1"><thead><tr><th>Measure</th><th>Implementation</th><th>Purpose</th></tr></thead><tbody><tr><td>**Development/Test Data**</td><td>Client production data is anonymized before use in dev/test environments</td><td>Minimize exposure of real personal data</td></tr><tr><td>**Logging**</td><td>Personal identifiers (emails, names) are redacted or hashed in system logs</td><td>Prevent leakage via logs</td></tr><tr><td>**AI Training Data**</td><td>Client data used for AI model fine-tuning is pseudonymized where feasible</td><td>Protect individual identities in training datasets</td></tr></tbody></table>

### 2.3 Access Control

<table id="bkmrk-measureimplementatio-2"><thead><tr><th>Measure</th><th>Implementation</th><th>Purpose</th></tr></thead><tbody><tr><td>**Multi-Factor Authentication (MFA)**</td><td>Required for all production system access (Azure Portal, SSH, Bitwarden, Documenso, BookStack admin)</td><td>Prevent unauthorized access</td></tr><tr><td>**Role-Based Access Control (RBAC)**</td><td>Azure AD roles limit production access to designated personnel only</td><td>Need-to-know principle</td></tr><tr><td>**SSH Key Authentication**</td><td>Password authentication disabled; only SSH keys allowed for server access</td><td>Prevent brute-force attacks</td></tr><tr><td>**API Token Rotation**</td><td>Quarterly rotation of service API tokens</td><td>Limit token exposure window</td></tr></tbody></table>

### 2.4 Logging and Monitoring

- **Audit Logs:** All access to production databases and personal data logged with timestamps, user ID, action
- **Retention:** Logs retained for 90 days (compliance requirement)
- **Alerting:** Failed login attempts, unauthorized access attempts trigger alerts to CEO
- **Review:** Monthly log review for anomalies

### 2.5 Security Updates

- **Patch Cycle:** Monthly security updates for OS and dependencies
- **Dependency Scanning:** Automated vulnerability scanning via Dependabot (GitHub) and npm audit
- **Critical Patches:** Applied within 48 hours of disclosure for high-severity vulnerabilities

### 2.6 Penetration Testing

- **Frequency:** Annual external penetration testing (planned Q4 2026)
- **Scope:** Web applications, API endpoints, authentication mechanisms
- **Remediation:** High/critical findings remediated within 30 days

## Organizational Measures

### 3.1 Personnel Security

<table id="bkmrk-measureimplementatio-3"><thead><tr><th>Measure</th><th>Implementation</th><th>Purpose</th></tr></thead><tbody><tr><td>**GDPR Training**</td><td>Annual GDPR training for all staff with data access</td><td>Ensure awareness of data protection obligations</td></tr><tr><td>**Confidentiality Agreements**</td><td>All employees and contractors sign NDAs covering client data</td><td>Legally binding confidentiality</td></tr><tr><td>**Background Checks**</td><td>Reference checks for all hires with production access (Norway/Bosnia)</td><td>Vet trustworthiness</td></tr><tr><td>**Access Termination**</td><td>All access revoked within 24 hours of employee/contractor departure</td><td>Prevent ex-employee access</td></tr></tbody></table>

### 3.2 Access Management

- **Need-to-Know Principle:** Access granted only when documented business need exists
- **Access Review:** Quarterly review of who has production access; revoke unnecessary permissions
- **Temporary Access:** Time-limited credentials for contractors (expire after engagement)

### 3.3 Backup and Recovery

<table id="bkmrk-measureimplementatio-4"><thead><tr><th>Measure</th><th>Implementation</th><th>Target</th></tr></thead><tbody><tr><td>**Backup Frequency**</td><td>Daily automated backups of all databases</td><td>RPO: 24 hours (max data loss)</td></tr><tr><td>**Backup Location**</td><td>Azure Blob Storage (geo-redundant, EU region)</td><td>Survive regional outage</td></tr><tr><td>**Recovery Time**</td><td>Tested quarterly restore procedures</td><td>RTO: &lt;24 hours (time to restore)</td></tr><tr><td>**Backup Encryption**</td><td>AES-256 encryption at rest</td><td>Protect backup data</td></tr></tbody></table>

### 3.4 Incident Response

**Data Breach Response Plan:**

1. **Detection:** Automated alerts + manual log review
2. **Containment:** Immediate isolation of affected systems (within 1 hour)
3. **Assessment:** Determine scope: what data, how many records, what breach type
4. **Notification:**
    - Client notification within **24 hours** of breach discovery (per DPA)
    - Datatilsynet (Norwegian DPA) notification within 72 hours if required by GDPR
5. **Remediation:** Patch vulnerability, restore from backup if needed
6. **Documentation:** Full incident report with timeline, root cause, remediation steps

**Incident Contact:** alem@alai.no (CEO, available 24/7 for critical incidents)

### 3.5 Data Retention and Deletion

<table id="bkmrk-data-typeretention-p"><thead><tr><th>Data Type</th><th>Retention Period</th><th>Deletion Method</th></tr></thead><tbody><tr><td>**Client personal data (production)**</td><td>Duration of contract + 30 days post-termination</td><td>Secure deletion (multi-pass overwrite or Azure storage deletion)</td></tr><tr><td>**Backups**</td><td>90 days rolling window</td><td>Automatic expiry</td></tr><tr><td>**Audit logs**</td><td>90 days</td><td>Automatic expiry</td></tr><tr><td>**Signed contracts (NDA, Retainer, DPA)**</td><td>7 years (Norwegian accounting law)</td><td>Archived at archive.alai.no per ZAKON ARCHIVE FIRST</td></tr></tbody></table>

**Data Deletion Verification:** Upon contract termination, ALAI provides written confirmation of data deletion within 30 days (per DPA section 3.7).

## Sub-Processor Security

ALAI relies on sub-processors for infrastructure and AI services. Each sub-processor has been vetted for GDPR compliance:

<table id="bkmrk-sub-processorcertifi"><thead><tr><th>Sub-Processor</th><th>Certifications</th><th>Data Location</th></tr></thead><tbody><tr><td>**Anthropic PBC**</td><td>SOC 2 Type II, GDPR DPA, SCCs</td><td>USA (AWS us-east-1)</td></tr><tr><td>**Microsoft Azure**</td><td>ISO 27001, SOC 2, GDPR compliant</td><td>EU West / Norway East</td></tr><tr><td>**Cloudflare Inc.**</td><td>ISO 27001, SOC 2 Type II, GDPR DPA</td><td>Global (EU data residency)</td></tr><tr><td>**Brevo**</td><td>GDPR compliant, ISO 27001</td><td>EU (Frankfurt)</td></tr></tbody></table>

See [DPA Template](https://docs.alai.no/books/legal-templates-v1/page/dpa-template-v1-gdpr-article-28) for full sub-processor details and 30-day notice policy.

## Compliance and Audit

- **Annual TOMs Review:** CEO reviews and updates this document annually or upon material security changes
- **Client Audit Rights:** Clients may audit ALAI's compliance with TOMs (1x/year free, additional by agreement)
- **External Audit:** SOC 2 Type I audit planned Q4 2026 (post-AI Services launch)

## Limitations and Disclaimers

**⚠️ Current Status: DRAFT**

This TOMs document is based on ALAI's existing infrastructure and planned security posture. Final validation pending:

1. **Security audit:** External review not yet conducted (planned Q4 2026)
2. **ISO 27001:** Not yet certified (est. cost 150K NOK, 6-month timeline if client requires)
3. **SOC 2:** Type I audit planned Q4 2026 (Type II requires 6-12 month observation period)

If client requires formal certification (ISO 27001, SOC 2 Type II), CEO will assess feasibility and cost impact.

## Document History

- **v1.0 (2026-05-01):** Initial version (Lexicon + Proveo 19/20 PASS)
- **Next Review:** 2027-05-01 (annual) or upon first security audit

---

**Source File:** `~/Public/legal/ai-services/TOMs-ALAI-AI-Services-v1.md`  
**Full document available at source location (13K file).**

*Referenced by [DPA Template v1](https://docs.alai.no/books/legal-templates-v1/page/dpa-template-v1-gdpr-article-28) as Annex B.*