Trust and Security Overview

Operator: Urbano DX (EU / Poland) Contact: urbano@urbanodx.com Last updated: 2026-08-01

Urbano DX designs, builds, and operates custom software for clients, including AI-assisted features. This page is our single answer to security, privacy, and AI-compliance questionnaires. It links to the AI Governance Framework, the Data Processing Agreement, and the Subprocessor Register.

Certifications and frameworks

Security and compliance certifications currently held: none. We do not hold SOC 2, ISO/IEC 27001, ISO/IEC 42001, HIPAA, or PCI-DSS certifications, and we do not claim to. We would rather state this plainly than fail a review on an overstated claim.

Partner programs (not security certifications). Urbano DX is an OpenAI Select Partner in the OpenAI Partner Network, effective August 2026. We list it here so it is not mistaken for something it is not: a partner tier reflects program participation and training, and it is not a security certification, not an independent audit, and not an endorsement of our products by OpenAI. It grants us no access to your data and changes nothing in this document. If a questionnaire asks for evidence of security assurance, the honest answer remains the one above: none held.

Frameworks we adhere to and align with:

GDPR (Regulation (EU) 2016/679). As an EU-based operator this is a legal

obligation. We publish privacy policies, honour data-subject rights, use a DPA, and maintain a subprocessor register.

EU AI Act (Regulation (EU) 2024/1689). We operate as a deployer of AI. Our uses

are minimal-to-limited risk; where a system interacts with a person, we meet the Article 50 transparency obligation. See the AI Governance Framework.

NIST AI Risk Management Framework. Our AI controls are mapped to the RMF's

Govern / Map / Measure / Manage functions in the governance framework.

ePrivacy / PECR for cookies and electronic marketing. Stated as facts you can

check rather than as a compliance claim: urbanodx.com runs no advertising, remarketing or cross-site tracking tags (Google Tag Manager and the ad pixel it carried were removed on 2026-07-24). What remains is functional browser storage plus a Firebase product-analytics identifier, loaded only after you interact with the site. Newsletters use double opt-in and carry an unsubscribe link. We do not run a cookie consent banner on the marketing site; see Honest limitations.

On the roadmap: ISO/IEC 42001 (AI management system) alignment is our target AI-specific standard. SOC 2 would be pursued only if an enterprise engagement requires it.

AI governance in brief

When we build AI features, a human stays in the loop. Anything an AI produces is reviewed before it takes effect, and no feature spends money, sends external messages, deploys to production, or changes a legal or financial state without a human approval step. The full framework, including the risk classification and the escalation procedure, is in the AI Governance Framework.

Data protection and privacy

Roles. For customer engagements Urbano DX acts as a processor under the

DPA; for its own marketing site it is the controller.

Data-subject rights. Requests to access, correct, or delete personal data are

handled at urbano@urbanodx.com.

Data residency and transfers. This marketing site, its backend and its database

run in the EU (Hetzner, Nuremberg, Germany); other components of our own platform also run on a rented node and on self-hosted hardware in Kraków, Poland. Some subprocessors (for example authentication, payments, and some model providers) are outside the EEA; those transfers rely on the SCCs and, where applicable, adequacy decisions. The primary LLM endpoint we use is EU-region (Amsterdam). See the subprocessor register.

Retention and deletion. For client engagements, personal data is deleted or

returned at the end of the engagement unless retention is legally required. For our own marketing site, retention is enforced by automatic database expiry rather than by intention: contact-form submissions expire 24 months after receipt, AI diagnostic sessions and transcripts 12 months after creation. On-request erasure is run against all three collections that hold a person's data. Backups are a separate rotation: a deleted record can persist in an existing backup snapshot until that snapshot ages out, which we do not defeat by editing backups.

No model training on customer data. See the governance framework.

Security controls (technical and organisational measures)

These form Annex II of the DPA:

In transit: TLS everywhere via Traefik and Cloudflare.
Network isolation: internal services communicate over an internal network and are

never routed through the public edge. Internal service endpoints are not publicly exposed; access control is by network isolation.

Access control: admin and operator surfaces are gated by email allowlists;

product user auth is via Firebase.

Secrets: held in environment configuration on the deploy host, provisioned from

encrypted CI secrets, and not committed to source control. Secrets are not exposed to models; a broker leases redacted secrets to the execution layer.

AI-specific: untrusted input is sanitised before it reaches a model

(prompt-injection defence); models are not given secrets, and consequential actions require a human approval step.

Backups: application databases are dumped daily on a fixed schedule, kept on the

host for a short rolling window, and replicated to encrypted off-host object storage. A restore drill runs on a schedule rather than being assumed to work.

Logging and error tracking: centralised application logging and a self-hosted

error tracker.

Change management: deploys run through CI on push to the production branch, with

post-deploy QA sweeps.

Incident response

On becoming aware of a personal-data breach affecting a customer's data, we notify the affected customer without undue delay and provide the information they need to meet their own obligations (see DPA, Section 7). Security issues can be reported to urbano@urbanodx.com.

Honest limitations

We keep this list current so reviewers can trust the rest of the page:

No third-party security or AI certifications yet (stated above).
AI governance is applied per engagement, not yet operated as an externally certified

management system.

Content safeguards for AI features are built into each system's design and human

review, not a separate moderation service.

No cookie consent banner on urbanodx.com. Advertising and tag-manager scripts are

gone, but Firebase product analytics still sets an identifier without asking first. Under a strict reading of ePrivacy that identifier would need consent. The options are a banner or dropping that analytics; we have not chosen yet.

We are one person. There is no separate security team, no 24/7 on-call rota, and no

segregation of duties: the same operator writes, reviews and deploys the code.

The security controls above describe current practice. They are not a statement about

every line of this repository's history.

How to request documents

Customers and reviewers can request the current DPA, subprocessor register, and this overview, or ask a specific questionnaire question, at urbano@urbanodx.com.