Trust Center

Trust, made demonstrable

At Nostrion, trust is about more than secure technology. We build our services on four pillars: data sovereignty, responsible AI, security & privacy and demonstrable control. This is how we keep your data under European control, keep people in charge when AI is used and make clear how we protect data and systems.

In our Trust Center you can read what we promise, how we have arranged it and how we demonstrate that we keep those commitments.

Responsible and Transparent

• Human direction: AI supports human decision-making. The final assessment always remains with the user.
• No training on client data: your data is not used to train AI models. We process it only to provide our services.
• Transparent AI: we are clear about where and for what purpose AI is used. We are also transparent about its limitations.
• Controlled output: AI results are not used unchecked as a final judgement. Human assessment remains decisive.

Data sovereignty

• Processing within the EU: your data is stored and processed exclusively within the EU. This applies to the entire processing chain.
• European jurisdiction: your data is never processed on systems that fall under the laws of countries outside the EU.
• Sovereign chain: our requirements for European location and jurisdiction apply to our entire infrastructure and supplier chain.
• Your data stays yours: your data is processed exclusively for the agreed services and not for any other purpose.

Compliance

• ISO 27001: Certified
• NEN 7510: Certified
• ISO 42001: Certified
• GDPR: Compliant

Certificates

• Certificate ISO 27001 – Nostrion
• Certificate ISO 27001 – Fidacta
• Certificate ISO 27001 – Accounce
• Certificate NEN 7510 – Nostrion
• Certificate NEN 7510 – Fidacta
• Certificate NEN 7510 – Accounce
• Certificate ISO 42001 – Nostrion
• Certificate ISO 42001 – Fidacta
• Certificate ISO 42001 – Accounce

Scope

• Statement of Applicability – ISMS (ISO 27001 / NEN 7510)
• Statement of Applicability – AIMS (ISO 42001)

Implementation

Data & Access

Where is my data and who has access to it?

Client data within the Nostrion Platform is stored and processed exclusively within the European Union, on European infrastructure and within European jurisdiction. Our services are set up according to sovereignty by design.

Client environments are separated from each other, and one client’s data is not accessible or available to other clients. Access to systems and management functions is controlled and restricted on the basis of roles and responsibilities. Nostrion employees have no access to client data within the Nostrion Platform.

Data Use & Privacy

What happens to my data when I use AI?

Client data is processed exclusively to deliver the agreed services. Nostrion does not use client data to train, fine-tune or improve general AI models. Our AI model suppliers are likewise not permitted to use client data, prompts and AI output for their own purposes.

In line with privacy by design, we limit the processing and storage of data to what is necessary for the functionality concerned. Set retention periods apply to different types of data, after which the data is deleted. Only when a client explicitly commissions the training or fine-tuning of a specific model are separate agreements made on purpose, data and conditions.

Responsible AI & Human Oversight

How do you ensure that AI remains responsible and under human oversight?

AI at Nostrion supports people and does not make autonomous decisions. The user remains responsible for assessing and applying AI output. Human oversight is therefore a fixed principle in the design and deployment of our AI solutions.

Within our AIMS we assess and control AI-specific risks, including incorrect output, bias, explainability and model behaviour. AI solutions are tested and evaluated and remain under monitoring throughout their lifecycle. This is how we combine the capabilities of AI with demonstrable human oversight and risk control.

Security

How do you protect our environment against security risks?

Information security is a structural part of the design, development and management of our services. Based on security by design, we apply security measures to areas including access, data protection, development, changes, logging and monitoring.

Security is managed within our ISMS, in accordance with ISO 27001 and NEN 7510. Vulnerabilities and security risks are actively assessed and followed up, and our software is structurally tested for vulnerabilities during development. This keeps security part of the entire lifecycle of our services.

Incidents

What happens if something goes wrong?

Security incidents and AI-related incidents are recorded, assessed and followed up according to a fixed process. In doing so we look not only at security but, where relevant, also at the reliability, availability and correctness of AI systems and AI output.

Incidents are investigated for cause, impact and required measures. Findings and improvement measures are embedded in our ISMS and AIMS, so that incidents are not only resolved but also contribute to the structural improvement of our services.

Suppliers & Partners

How do you know that suppliers handle my data with care?

Suppliers that are part of our services are assessed in advance and evaluated periodically throughout the relationship. We look at matters including information security, privacy, data sovereignty, continuity and the agreements on the processing and use of client data.

Additional requirements from our AIMS apply to suppliers that are part of our AI chain. Based on sovereignty by design, we also assess where data is processed, which jurisdiction the supplier falls under and which dependencies arise. This is how we maintain control over the entire chain through which our AI services are delivered.

Continuity & Availability

How do the services remain available and reliable?

Continuity is part of the set-up and management of our services. We assess risks that could affect the availability of our systems and AI services and have put measures and procedures in place to manage disruptions and restore services.

Within our ISMS, continuity and recovery measures are periodically assessed and tested. For AI services, we also use the AIMS to look at dependencies on AI models, infrastructure and suppliers. This is how we manage both technical and AI-specific continuity risks.

Demonstrable control

How do we know that the control measures actually work?

We not only record how we control information security and AI, but also test whether the agreed measures are actually carried out and effective. This is done within our ISMS and AIMS through monitoring, periodic checks, internal audits and management reviews.

Deviations and points for improvement are recorded and followed up. In addition, our management systems are independently assessed in the context of ISO 27001, NEN 7510 and ISO 42001. This is how we make control demonstrable rather than merely described.

Employees & Awareness

How do you ensure that employees handle data and AI responsibly and securely?

Our employees are made aware of their responsibilities regarding information security, privacy and responsible AI use. They periodically take awareness and AI literacy training tailored to their role and work.

Responsibilities, access rights and rules of conduct are laid down within our ISMS and AIMS. We look at the interplay between people, process and technology: technical measures are only effective when employees understand the risks and know how to act responsibly.

Changes & Innovation

How do you ensure that AI and the services can change in a controlled way?

AI technology is developing rapidly. New models, functionalities and changes are therefore not introduced into our services without assessment. Relevant changes are assessed for risks in advance and, where necessary, tested and validated before they are deployed.

Within our ISMS and AIMS we control changes throughout the entire lifecycle. We look at matters including security, privacy, reliability, AI risks and the consequences for existing control measures. This allows us to keep innovating without losing control over our services.

AI Use Cases & Applications

How do you determine for what AI can and cannot be used responsibly?

Not every application of AI carries the same risks. That is why we assess and register AI applications and use cases within our AIMS. We look at matters including the purpose of the application, the data involved, human oversight, possible impact and relevant AI risks.

New applications are assessed before they are deployed and re-evaluated during their lifecycle when circumstances or risks change. This is how we ensure that AI is used in a targeted way for applications that are controllable and responsible.

Sub-processors

Primary chain

Suppliers and infrastructure that are a direct part of our services and on which your data is processed. Our requirements for EU location and European jurisdiction apply to this entire chain.

Secondary chain

Suppliers and tooling that support our business operations but are not part of the processing of your data within the Nostrion Platform. These suppliers are assessed and managed separately within our supplier management.

Retention periods

Nostrion does not itself train or fine-tune AI models; training data is therefore not applicable. The periods above are taken from the internal data register and are reviewed periodically.

FAQ

Data sovereignty

Where is my data stored and processed?

Your data is stored and processed exclusively within the European Union. This applies to every layer of the primary processing chain, from content delivery (CDN) and hosting to AI infrastructure and processing by AI models.

You can find an up-to-date overview of the suppliers involved in our sub-processor overview.

Is my data subject exclusively to European laws and regulations?

Yes. Your data is processed exclusively within European infrastructure by parties that are subject to European laws and regulations. The primary processing chain is both EU-hosted and EU-owned.

As a result, your data is not processed via infrastructure or suppliers that fall under the laws of countries outside the European Union, such as the US CLOUD Act.

Are American cloud providers used?

All processing within the Nostrion Platform takes place via European infrastructure and European suppliers. We do not use American cloud providers for this.

Can a non-European government gain access to my data?

Our infrastructure is set up so that your data within the Nostrion Platform is processed and stored exclusively by EU-hosted and EU-owned parties. As a result, the processing of your data does not fall under laws that could give non-European governments, such as the United States, access to this data via the supplier concerned.

Does European jurisdiction apply to the entire processing chain?

Yes. The entire processing chain within the Nostrion Platform is EU-hosted and EU-owned. This applies to all infrastructure and suppliers involved in storing, processing or transferring your data within the Nostrion Platform.

Your data therefore remains within European jurisdiction throughout the entire processing.

Which suppliers process my data?

You can find an up-to-date overview of the suppliers involved in processing your data within the Nostrion Platform in our sub-processor overview. It shows, for each supplier, the role it fulfils within our services.

What is the difference between your primary and secondary supplier chain?

The primary supplier chain consists of suppliers that are part of the Nostrion Platform and may be involved in processing your data.

The secondary supplier chain consists of suppliers and tooling that support our business operations. These systems sit outside the Nostrion Platform, and no client data is processed or stored in them.

AI & use of data

Is my data used to train AI models?

No. Within our regular services, your data is not used to train, fine-tune or otherwise improve AI models.

On a client’s instructions, we can train or fine-tune a specific model, for example for an organisation or sector. This is done exclusively on the basis of an explicit commission and agreement, which sets out in advance which data is used, for what purpose and under what conditions.

Can AI model suppliers use my data for their own purposes?

No. Suppliers within the Nostrion Platform are not permitted to use your data, prompts and AI output for their own purposes, including training or improving their own models or services. This is contractually agreed with our suppliers.

The developers of the models never receive your data: every model we use runs within our European AI infrastructure.

Which AI models does Nostrion use?

Within the Nostrion Platform we use different AI models for different functionalities. Not every model is equally suited to every task. For example, we may use different models for speech-to-text, data extraction and creating summaries.

AI models are developing rapidly. That is why we continuously evaluate whether the models in use are still the right choice for their application, or whether a newer or different model is better suited.

We use curated models made available within our European AI infrastructure through our infrastructure partners, currently Nebul.

Because our model range may change, we do not publish a static list of the models used. Would you like to know which models are currently used within our services? Please contact us. We provide transparent insight into this.

Does Nostrion use open-source, open-weight or commercial AI models?

We build on open-weight models by choice: models whose weights are publicly available, so we can run them entirely within European infrastructure. Our model range keeps moving further in that direction.

We select the model that best fits each function, drawing on the curated model catalogue of our infrastructure partner Nebul.

Any other model we use also runs within the European infrastructure of our partners. Your data is never sent to the model’s developer, and within the Nostrion Platform it stays EU-hosted and EU-owned.

Which models we use may change, because we continuously assess which model is most suitable for a specific application.

Are prompts and AI output stored?

Yes. Prompts and generated AI output may be stored within the Nostrion Platform as part of our services. This data is processed exclusively within the arrangements agreed with the client in the data processing agreement (DPA).

Set retention periods apply to storage. You can find an up-to-date overview under Retention periods in our Trust Center.

Can data from different clients be mixed?

No. Client environments are separated from each other. One client’s data, prompts, documents and AI output are not made available to, or used for, the processing of another client.

At present, clients work in separate environments with their own infrastructure. If we run parts of our services as multi-tenant in the future, the logical separation between clients will remain safeguarded.

Does AI make decisions on its own?

No. Within our services, AI is used to support the user. AI output does not lead to decisions or actions on its own without human intervention.

Human assessment and oversight remain decisive. The user remains responsible for the final assessment and the use of the AI output.

How does Nostrion check the quality of AI output?

We continuously test and evaluate the performance and output of our AI models and AI solutions. In this way we monitor whether they continue to function as intended and remain suitable for the application for which they are used.

At the same time, human oversight remains decisive. AI output is supportive, and the user always remains responsible for the assessment and final use of the output.

Security, privacy & compliance

Which certifications does Nostrion hold?

Nostrion, Fidacta and Accounce are certified to ISO 27001, NEN 7510 and ISO 42001.

ISO 27001 and NEN 7510 fall within our Information Security Management System (ISMS). ISO 27001 focuses on the control of information security. NEN 7510 was developed specifically for the healthcare sector and sets additional requirements for the protection of health information and other sensitive personal data.

ISO 42001 falls within our Artificial Intelligence Management System (AIMS) and focuses specifically on the governance, risks and responsible development, deployment and control of AI.

Information security and AI governance are therefore managed within separate but aligned management systems.

You can find the current certificates and the scope of our management systems in our Trust Center.

What do ISO 27001 and NEN 7510 mean for me as a client?

ISO 27001 and NEN 7510 mean that the security of your information is controlled structurally and demonstrably at our organisation. Our ISMS describes how we handle matters including access security, risk management, incidents, suppliers, logging, continuity and data protection.

NEN 7510 supplements this with specific requirements for the protection of health information and other sensitive personal data. The standard comes from the healthcare sector, but we apply the additional safeguards we have put in place for it more broadly within our organisation.

For you as a client, this means that information security does not consist only of technical measures, but is part of a certified management system that is periodically and independently assessed.

What does ISO 42001 mean for me as a client?

ISO/IEC 42001 means that we not only develop and deploy AI technically, but also control it demonstrably. Within our AIMS we have laid down how we handle matters including AI risks, human oversight, transparency, suppliers, monitoring and changes throughout the lifecycle of our AI solutions.

For you as a client, this means that the responsible use of AI is a structural part of our business operations and is independently assessed.

Our AIMS also forms the foundation on which we control and demonstrate compliance with relevant obligations under the EU AI Act.

How does Nostrion deal with the EU AI Act?

For each AI solution and use case, we assess which role Nostrion fulfils under the EU AI Act, which risk classification applies and which obligations follow from it.

The relevant obligations are translated within our AIMS into concrete control measures. We look at matters including transparency, human oversight, risk control, monitoring and documentation.

The regulatory framework around the EU AI Act is still very much developing and is being further fleshed out through guidelines, implementing rules and standards, among other things. We follow these developments continuously and adjust our control measures when new or amended obligations give reason to do so.

This is how we use our AIMS as the governance foundation for structurally controlling and demonstrating compliance with the EU AI Act obligations relevant to our AI solutions.

What role does Nostrion have under the EU AI Act?

Nostrion’s role under the EU AI Act depends on the specific AI solution and the way in which it is offered or used. That is why we determine for each AI solution and use case which role applies.

Provider: when we develop an AI system, or have one developed, and offer it or put it into service under our own name, Nostrion may act as provider. In that role we are responsible for the obligations that the EU AI Act places on the provider of that AI system.

Deployer: when we use an AI system under our own responsibility, we may act as deployer. In that case the obligations that come with the responsible deployment and use of the AI system concerned apply.

The allocation of roles is recorded within our AIMS and periodically reassessed, for example when an AI solution, its intended use or our position in the chain changes.

Can Nostrion support clients in carrying out a DPIA?

Yes. Responsibility for carrying out a DPIA lies with the client when, as controller, it determines for what purpose and in what way our AI solution is used.

Nostrion supports clients in this with our “DPIA Self-Start”. This document contains information about our services that the client can use as the basis for its own DPIA.

If additional information or support is needed, we are available to support the client further. The assessment of and responsibility for the DPIA remain with the client as controller.

How is my data secured?

The security of your data is part of our ISO 27001 and NEN 7510 certified ISMS. Within it, we have put technical and organisational measures in place to protect information and systems.

In the Compliance section of our Trust Center we give a high-level insight into how we have organised this control. There you will also find our certificates and Statement of Applicability (SoA).

How is access to client data arranged?

Nostrion employees have no access to client data within the Nostrion Platform. Client data remains within the client’s environment and is accessible only to that client’s authorised users.

This means we do not merely limit who is permitted to have access: access to client data by Nostrion employees is ruled out within the regular services.

Is access to systems and data logged?

Yes. Within the Nostrion Platform, user activities and security-relevant events are logged. This includes logins, failed login attempts and relevant administrative and configuration changes.

Logging supports us in security, monitoring, incident investigation and demonstrating that our control measures work.

How does Nostrion deal with security and AI incidents?

Security incidents and AI-related incidents are handled within our existing incident management process. This gives us one integrated way of working for reporting, assessing, following up and evaluating incidents.

For AI-related incidents, an additional AI-specific assessment takes place where necessary, for example concerning the functioning of the AI system, undesirable output, risks and possible impact.

Incidents and the resulting improvement measures are followed up within our ISMS and AIMS, so that findings are structurally incorporated into our continuous improvement.

How long is my data retained?

We apply set retention periods per category of data and functionality. The retention period is aligned with the purpose for which the data is processed, and we do not retain data longer than necessary for that purpose.

You can find the current retention periods for chat history, audio recordings, transcriptions, documents and logging, among other things, under Retention periods in our Trust Center.

What happens to my data after the agreement ends?

After the agreement ends, we will in principle delete the personal data we process on your behalf within one month. The data is then no longer accessible or usable within our services.

If data is still available at the time the agreement ends, we can, on request, cooperate in making it available, insofar as this is technically possible.

Only where we are legally obliged to retain certain data for longer is it retained for the applicable statutory retention period, and it is not used for any other purpose.

What happens in the event of a data breach or security incident involving my data?

If a security incident may have consequences for your data or our services, we will inform you without undue delay and in principle within 24 hours of the incident being identified.

We inform you of the nature and possible impact of the incident and of the measures we are taking to limit the consequences and restore the services. If the investigation produces new relevant information, we keep you informed.

For each incident we also assess which statutory and contractual notification obligations apply. When we act as processor, we support the client with the information it needs, as controller, to meet any notification obligations of its own.

Can I audit Nostrion or request information about the security measures?

Compliance and security form the foundation of our organisation and services. We are proud of this and invest a great deal of time and attention in continuously improving them. That is why we are happy to be as transparent as possible about them.

Through our Trust Center we make a lot of relevant information available, including our certifications, Statements of Applicability (SoAs) and information about our control measures.

Are you missing information you need for your own risk, compliance or supplier assessment? Let us know. Where possible, we make additional information available.

Where additional assurance is required by laws and regulations, contractual obligations or supervision, an audit can also be carried out under the applicable conditions.

Does Nostrion carry out security testing?

Yes. Security testing is part of our development and management processes. We carry out automated Static Application Security Testing (SAST) to identify vulnerabilities in our software at an early stage.

In addition, we are currently setting up continuous pentesting. With this we aim to have the security of our platform tested on an ongoing basis, in addition to our automated security testing.

Findings from security tests are assessed and, where necessary, followed up within our existing security and development processes.

Governance & demonstrability

How does Nostrion safeguard the responsible use of AI?

The responsible use of AI is structurally safeguarded within our ISO 42001 certified Artificial Intelligence Management System (AIMS). With it, we control AI not only technically but throughout the entire lifecycle of our AI solutions. Our AIMS is periodically and independently assessed.

Within the AIMS we pay attention to matters including AI risk management, human oversight, transparency, monitoring, supplier management and the controlled implementation of changes.

Human direction is a fundamental principle in this. Our AI solutions support the user; AI output is not regarded as an autonomous decision, and the final assessment remains with the user.

The functioning and risks of our AI solutions are periodically evaluated. Findings and changes are followed up within the AIMS, so that the responsible use of AI is part of our structural and continuous control.

How is human oversight of AI arranged?

Human oversight is a fundamental principle within our AI services. Our AI solutions support the user, but do not make decisions or carry out actions on their own without human intervention.

The user remains responsible for assessing, checking and applying AI output. AI output should therefore be seen as support for the human process and not as a replacement for human assessment.

We also apply this principle within our own organisation. In the development, validation, monitoring and modification of AI solutions, human assessment remains part of the process. Internally, we therefore apply the same principles of human direction that we apply in our services.

How does Nostrion assess new AI systems and use cases?

New AI systems and use cases are assessed within our AIMS before they are put into use. They go through a fixed adoption process in which we look at matters including the intended use, information security, privacy, AI risks, governance, compliance and relevant statutory and contractual obligations.

Where relevant, we also carry out an AI impact assessment, for example for new applications or use cases with an elevated risk profile. We look at matters including possible impact, human oversight, transparency, explainability and foreseeable misuse.

An AI system is only put into use after assessment and approval, and is then included in our AI register. This gives us demonstrable insight throughout the rest of its lifecycle into the system, its intended purpose, the relevant risks and the control measures applied.

How are AI risks assessed?

AI risk management is a structural part of our AIMS. We identify and assess AI risks per AI system and use case and reassess them when systems, applications or circumstances change.

We look at risks in areas including privacy, security, fairness and bias, transparency and explainability, safety and performance, and dependencies on third parties, such as AI models, platforms and other external suppliers.

Identified risks are assessed for likelihood and impact and recorded in our risk register. If a risk does not fall within our set risk tolerance, additional control measures are taken or the AI system is not put into use.

How are suppliers assessed?

Suppliers that are part of our AI services are assessed before they are engaged and then periodically reassessed. We look at matters including contractual agreements, information security, privacy, data location and hosting, access management, availability and continuity.

Additional requirements apply to suppliers of AI models, AI platforms and other AI technology. We assess matters including the supplier’s transparency, the controllability of the technology used, the processing of data under applicable laws and regulations and the safeguards surrounding the use of client data.

Changes at suppliers are also taken into account in our assessment. If a supplier no longer meets our requirements or risk tolerance, additional measures are taken or the supplier is no longer used.

How are changes to AI systems controlled?

Changes to our AI systems are implemented in a controlled and planned way. Depending on the nature and impact of the change, we assess in advance what consequences it may have for the functioning of the AI system, existing AI risks and our services.

For significant changes, we assess whether new risks arise, existing risks change or additional control measures are necessary. Where necessary, relevant documentation, registers and control measures within our AIMS are also updated.

As a result, control of an AI system is not limited to its original development and deployment, but applies throughout the entire lifecycle of the system.

How does Nostrion monitor AI systems after deployment?

Our AI systems continue to be actively monitored and evaluated after deployment. We look at matters including deviations in the quality and reliability of AI output, signs of bias or unequal performance and changes in the behaviour of AI models that may indicate model drift.

User feedback, incidents and other signals from practice are also important input for this monitoring. This makes it possible to identify risks or undesirable behaviour that were not, or not sufficiently, foreseen in advance.

Findings are assessed within our AIMS and may lead to a reassessment of risks, additional control measures or an adjustment to how the AI system is used. This keeps the functioning of our AI solutions under active control throughout their entire lifecycle.

How can I check which control measures Nostrion has taken?

Our Trust Center is the central point for information on how we manage security, privacy and AI governance.

The control measures that fall within the scope of our certifications can be found in the associated Statements of Applicability (SoAs). Under Compliance we also give a high-level insight into the set-up of our ISMS and AIMS and the main elements of our control.

Do you need more information for your own supplier, risk or compliance assessment? Please contact us. Where possible, we provide additional information on the relevant control measures.

Can I receive additional information for my own supplier assessment?

Yes. We are happy to support clients with their own supplier, risk and compliance assessments.

Much of the information required is directly available through our Trust Center, including our certifications, Statements of Applicability (SoAs) and information about the set-up of our ISMS and AIMS.

Do you need additional information that is not available in the Trust Center? Please contact us. Where possible, we provide the additional information needed to support your assessment.

FAQ (notarial sector)

KNB AI-weegschaal

How does Nostrion align with the KNB AI-weegschaal?

The AI-weegschaal of the Royal Dutch Association of Civil-law Notaries (KNB) is the sector’s framework for assessing the responsible use of AI. Its name translates loosely as “AI scale”. It helps notaries to weigh the risks of AI against mitigating measures, taking into account the principles and core values of the notarial sector and principles for responsible AI use.

At its centre are six principles for the notarial sector: ethics, added value, responsibility, independence, security and future-proofing.

These principles align closely with the way we develop and control our AI solutions. In doing so, we look at the interplay between people, process and technology. Topics such as human control, transparency, privacy and security, reliability and the control of AI risks are a structural part of our AIMS and our services.

In the questions below, we therefore explain for each principle of the AI-weegschaal how our services support notaries in the responsible use of AI, with professional judgement and responsibility remaining with the notary.

How does Nostrion support notaries in the ethically responsible use of AI?

Ethical and societal risks are a structural part of the way we assess, develop and monitor AI solutions. This is safeguarded within our way of working and our ISO 42001-certified Artificial Intelligence Management System (AIMS).

Within the AIMS, we assess, among other things, risks relating to bias, transparency and explainability, privacy, security and the reliability of AI outcomes. Where risks are identified, we take appropriate control measures. We also continue to monitor and evaluate our AI solutions after they are put into use.

Responsible use also requires sufficient AI literacy. That is why we consider it important that users understand what AI can do, what limitations and risks are associated with it and why human judgement remains necessary.

For the notary, this means that responsible AI use is not just a principle, but is supported by a demonstrable and independently audited management system, combined with knowledge and awareness on the part of the user. Human control remains paramount: our AI supports the notary’s professional judgement, but does not take it over.

How does Nostrion support the responsible use of AI?

We do not deploy AI because we can, but where it genuinely adds value within notarial work. Our solutions are aimed at supporting tasks in which AI can contribute to, for example, efficiency, speed, quality or making information accessible and processing it.

We continuously develop our solutions further together with our clients. We discuss where new needs arise and follow how existing functionality performs in practice. Where necessary, we adjust functionality, and where AI can demonstrably add value, we extend our solutions further.

In this way, we are continually building an ever richer AI environment for the notarial sector, in which people, process and technology come together. Technology remains in support of the profession. The aim is not to take over the notary’s professional work, but to create room for precisely what the notary adds the most value to: substantive assessment, personal advice and contact with the client.

How does the notary remain in control when using AI?

Human control is a fundamental principle of our AI solutions. AI supports the notary in their work, but does not take autonomous professional decisions or actions without human intervention. The notary remains in control and assesses the AI output before it is applied within notarial practice.

In doing so, we make a clear distinction in responsibilities. Nostrion is responsible for the control and operation of our AI services and safeguards this through, among other things, our ISO 42001-certified AIMS. The notary remains responsible for the professional assessment and use of the output within the specific notarial practice.

In this way, we combine the possibilities of AI with the principle that professional judgement, due care and ultimate responsibility remain with the notary. This aligns with the principle of the assessment framework that AI systems should be seen as a supplement and that the notary must verify the accuracy of the outcomes themselves.

How does the notary retain their independence when using AI?

Our AI solutions are designed to support professional judgement, not to replace it. AI can analyse and structure information and generate proposals, but does not take over professional assessment or decision-making.

Within our ISO 42001-certified AIMS, we pay attention to risks that can affect the reliability and neutrality of AI outcomes, including bias, transparency and explainability.

In this way, AI remains a tool within notarial services and professional direction remains with the notary. This aligns with the principle of the assessment framework that the notary remains independent of technical systems and can continue to judge critically when using them.

How does Nostrion protect confidential information when AI is used?

The protection of confidential information is a fundamental part of our services. Our AI services are controlled through our ISO 27001- and NEN 7510-certified ISMS and our ISO 42001-certified AIMS. We apply security by design, privacy by design and sovereignty by design as principles in designing and managing our services.

Client data within the Nostrion Platform is processed exclusively within an EU-hosted and EU-owned processing chain and is not used to train or improve general AI models. Client environments are separated from each other and client data is processed exclusively for the agreed services.

In this way, we combine information security, privacy, data sovereignty and AI governance to protect confidential information throughout the use of our AI solutions. For notarial practice, this supports the secure use of AI in work where confidentiality and professional secrecy are essential.

How does Nostrion help the notarial sector remain future-proof?

AI is developing rapidly. That is why we do not only build for today’s possibilities, but continuously develop our AI solutions further. New technology, changing needs from notarial practice and developments in laws and regulations are actively monitored.

New possibilities are assessed and introduced in a controlled way within the frameworks of our ISO 42001-certified AIMS. In this way, we combine innovation with responsible AI use, with people, process and technology developed and controlled in conjunction, without losing sight of control, human oversight and security.

Technology alone is not enough. AI literacy is essential to be able to use AI responsibly and effectively. That is why we consider it important that users understand what AI can do, where the limitations and risks lie and what role human judgement continues to play. In this way, we support the notarial sector not only with new AI technology, but also in using it responsibly. This aligns with the principle of the assessment framework that keeping knowledge of AI up to date is part of a future-proof notarial practice.

Information Security Code of Conduct for the Notarial Sector (GIN)

How does Nostrion align with the Information Security Code of Conduct for the Notarial Sector (GIN)?

The Information Security Code of Conduct for the Notarial Sector (Gedragscode Informatiebeveiliging Notariaat, GIN) is an important security framework for the notarial sector. Our services are set up to meet the GIN requirements relevant to Nostrion and to support notarial firms in meeting the requirements that relate to our services.

The security measures for this are structurally safeguarded within our ISO 27001- and NEN 7510-certified ISMS. We apply security by design as a principle in designing, developing and managing our services. This includes, among other things, access security, logging and monitoring, incident management, change management, secure software development, continuity and supplier management. These topics align with the security areas covered in the GIN.

The GIN is written primarily for the notarial firm and its system administration. As a result, not every individual requirement applies one-to-one to Nostrion as a service supplier. Where a specific requirement does not apply directly because of our role, we assess the underlying security objective and meet it with an appropriate control measure.

In the questions below, we explain for each relevant GIN topic how Nostrion addresses it within our services.

How has Nostrion embedded information security in its organisation?

Information security is structurally organised within Nostrion through our ISO 27001- and NEN 7510-certified Information Security Management System (ISMS). It sets out the information security policy, responsibilities and control measures for information security.

Roles and responsibilities for information security and privacy are clearly assigned. The policy and the operation of the ISMS are evaluated periodically and, where necessary, adjusted to changes in our organisation, services, risks and relevant laws and regulations.

We also pay structural attention to employee awareness and knowledge, so that information security is not only laid down in policy, but is part of our day-to-day way of working.

In this way, within our role as a service supplier, we give effect to the organisational principles of the GIN concerning information security policy, responsibilities and awareness.

How does Nostrion secure the exchange of data?

The protection of data is part of our AI services from the design stage. We apply three interrelated design principles: security by design, privacy by design and sovereignty by design.

Within our services, data is exchanged via secure connections and controlled interfaces. We apply appropriate security measures to protect data in transit against unauthorised access, interception or alteration. This aligns with the GIN requirements for secure data exchange.

Based on privacy by design, we limit the processing of personal data to what is necessary for the services. Based on security by design, we build security into our systems and processes from design and development onwards.

With sovereignty by design, we go one step further: client data within the Nostrion Platform remains within an EU-hosted and EU-owned processing chain throughout the entire processing and is not processed via systems that fall under non-European jurisdiction.

As a result, security, privacy and data sovereignty are not additional measures added afterwards, but principles in the design and management of our services.

How does Nostrion handle confidential data and documents?

All client data processed within the Nostrion Platform is treated as confidential by default, regardless of the nature or content of the data. This means we apply one clear level of protection to client data and align with the GIN principle that non-public information is treated as highly confidential.

The protection of this data is part of our ISO 27001- and NEN 7510-certified ISMS. Based on privacy by design and security by design, we limit processing and access to what is necessary for the services and apply appropriate technical and organisational security measures.

Our principle of sovereignty by design also applies: client data within the Nostrion Platform remains within our EU-hosted and EU-owned processing chain and is not processed via systems that fall under non-European jurisdiction.

In this way, confidentiality is not determined by a separate assessment of each document, but is the default starting point for all client data within our AI services.

How does Nostrion secure access to the Nostrion Platform?

Access to the Nostrion Platform is set up according to the principle of least privilege: users and administrators are given access only to the information and functionality they need for their role.

Access is linked to individual user accounts and is protected with multi-factor authentication (MFA). We also apply security measures against unauthorised access, including protection against brute-force attacks and misuse of authentication facilities. Shared user accounts are not permitted.

Access rights are controlled throughout the entire lifecycle of an account. Rights are granted, changed and revoked when roles or circumstances change, and are reviewed periodically. Security-relevant authentication and administration activities are logged and monitored.

Additional security measures and stricter access restrictions apply to administration activities. In this way, our measures align with the GIN principles for identification, authentication, access management, administrator rights and periodic review of authorisations.

How is the physical security of Nostrion’s services arranged?

The physical security of our services is set up on the basis of the nature of our services. Nostrion does not process client data on local servers within our office environment. The infrastructure on which client data is processed is located in professional data centres within the EU.

The physical security of the infrastructure on which our AI services run is therefore part of the secured supplier and infrastructure chain. The security of these suppliers is covered within our ISO 27001- and NEN 7510-certified ISMS and our supplier management.

Appropriate physical and organisational security measures apply to our own working environment for equipment, workstations and access to information. In line with our principles of security by design and privacy by design, we limit the processing and local storage of client data as much as possible. Based on sovereignty by design, we select and assess the infrastructure and supplier chain partly on the basis of location, ownership and applicable jurisdiction.

Some of the physical measures in the GIN are aimed specifically at the office environment of the notarial firm. For Nostrion, we apply the relevant security objectives to our own working environment and to the infrastructure that forms part of our services.

How does Nostrion handle security incidents?

Nostrion has an established process for identifying, reporting, assessing, containing and following up security incidents. This process is part of our ISO 27001- and NEN 7510-certified ISMS and aligns with the GIN requirements for incident management.

Incidents are registered and assessed on, among other things, impact, severity and possible consequences for clients and data. Where an incident relates to our AI services, the same process also assesses whether an AI-specific analysis and follow-up under our ISO 42001-certified AIMS is necessary.

When an incident affects a client, we inform the client concerned in accordance with the applicable legal and contractual obligations and the notification periods established for this.

After resolution, incidents are evaluated where necessary, and improvement measures are recorded and followed up. In this way, we use incident management not only for recovery, but also for the structural improvement of our information security and AI governance.

How does Nostrion safeguard security and awareness among employees?

Information security starts with the people who work with our systems and information. That is why screening, confidentiality, awareness and knowledge are a structural part of our personnel policy and our ISO 27001- and NEN 7510-certified ISMS.

Employees are appropriately screened before starting their work, including by means of a Certificate of Conduct (Verklaring Omtrent het Gedrag, VOG). The GIN specifies a particular screening profile for the notarial sector. Because this profile does not correspond directly to our role as a technology and service supplier, we apply a VOG screening appropriate to our work, through which we meet the same underlying security objective.

Employees are bound by confidentiality and information security obligations and receive periodic security and privacy awareness training. Obligations regarding access to information and confidentiality are also addressed when employees change roles or leave the company.

For Nostrion, awareness also goes beyond traditional information security. Through our ISO 42001-certified AIMS, we pay structural attention to AI literacy. Employees must understand, as appropriate to their role, what AI can do, what limitations and risks are associated with it and what responsibilities apply in the development and use of AI.

In this way, we combine the personnel security measures of the GIN with AI-specific knowledge and awareness suited to our services.

How does Nostrion safeguard the technical security of the Nostrion Platform?

The technical security of the Nostrion Platform is structurally safeguarded within our ISO 27001- and NEN 7510-certified ISMS. We apply security by design as a principle: security is taken into account throughout the entire lifecycle of our systems and services.

This includes, among other things, the control of assets and configurations, changes and updates, vulnerabilities and patches, malware, encryption, network security, backup and recovery, logging and monitoring. Security-relevant events are recorded and, where necessary, monitored so that deviations and possible security incidents can be detected in good time.

Software development also falls within this control. We apply secure development and carry out security testing to identify and control vulnerabilities during the development and modification of our services. In this way, our approach aligns with the technical security areas covered within the IT security management of the GIN.

For our AI services, this technical security is supplemented with the control measures of our ISO 42001-certified AIMS, so that, in addition to traditional IT security, AI-specific risks are also assessed and controlled throughout the lifecycle.

How does Nostrion safeguard the continuity of its services?

The continuity of our services is structurally safeguarded within our ISO 27001- and NEN 7510-certified ISMS. For this purpose, we maintain a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP) for organisational continuity and technical recovery, respectively, in the event of disruptions and emergencies.

Critical business processes are assessed for risks, vulnerabilities and the consequences of possible outages. Dependencies on systems, infrastructure and suppliers are also taken into account, and recovery priorities and recovery objectives are established.

For technical disruptions, recovery procedures are in place for restoring systems, applications and data. Backup, recovery and, where possible, redundancy form part of our recovery strategy.

The effectiveness of our continuity and recovery measures is tested and evaluated periodically. Findings from exercises and actual incidents are used to improve the measures further.

In this way, our measures align with the GIN principles for preparing for emergencies, organising recovery and periodically testing continuity measures.

How does Nostrion control security risks in the supplier chain?

Suppliers that form part of our services are assessed in advance and periodically for relevant security, privacy and continuity risks. Security requirements are laid down contractually where relevant and also apply to parties engaged within the supplier chain. In this way, we align with the requirements the GIN sets for the control of service suppliers and subcontractors.

For suppliers that process client data, we also apply our principle of sovereignty by design. Client data within the Nostrion Platform is processed exclusively within an EU-hosted and EU-owned processing chain and is not processed via systems that fall under non-European jurisdiction.

Suppliers are assessed on, among other things, their security measures, data processing, hosting location, contractual arrangements, use of sub-processors and relevant certifications or other assurance. For suppliers of AI technology, we also assess AI-specific risks, including the handling of client data and dependencies on models and suppliers.

As a result, the same principle continues to apply when parts of our services are provided by external suppliers: the protection, confidentiality and sovereignty of client data must remain demonstrably under control.

Is more information available on how Nostrion complies with the GIN?

Yes. In addition to the information in our Trust Center, we have a comprehensive GIN assessment available in which we explain, for each control measure of the Information Security Code of Conduct for the Notarial Sector, how Nostrion addresses it within our services.

This assessment provides more detail on the measures behind the topics described in outline in this FAQ and can be used, among other things, to support a notarial firm’s supplier, risk or compliance assessment.

The comprehensive GIN assessment is available on request for clients and notarial firms.

AI in notarial practice

Can I safely process confidential client information with Nostrion’s AI solutions?

Yes. Our AI solutions are specifically set up for processing confidential and sensitive information. All client data within the Nostrion Platform is treated as confidential by default, regardless of the nature or content of the data.

The protection of this information is safeguarded within our ISO 27001- and NEN 7510-certified ISMS and, for our AI services, is supplemented by our ISO 42001-certified AIMS. We apply security by design, privacy by design and sovereignty by design as principles.

Client data is processed exclusively within an EU-hosted and EU-owned processing chain and is not processed via systems that fall under non-European jurisdiction. In addition, client data is not used to train or improve general AI models.

Our services are therefore set up so that information subject to high requirements for confidentiality, privacy and control within notarial practice can also be processed with AI in a controlled way.

Does the information I enter remain within my own environment?

Yes. Within our services, client data is processed separately from the data of other clients. Documents, prompts, entered data and AI output of one notarial firm are not available to other clients and are not used within their environment.

This separation is a fundamental principle of the architecture of the Nostrion Platform and remains safeguarded as the platform develops further.

At the same time, our principle of sovereignty by design applies. Client data is processed exclusively within our EU-hosted and EU-owned processing chain, and client data is not processed via systems that fall under non-European jurisdiction.

As a result, information remains both logically separated from other clients and within the sovereign processing environment of our services.

Are my documents, prompts or AI output used to train AI models?

No. Client data, including documents, prompts and AI output, is not used within our regular services to train, fine-tune or improve AI models.

This principle also applies to the AI model suppliers within our processing chain: they may not use client data, prompts and output for their own purposes, including training or improving their models.

Only when a client explicitly instructs Nostrion to train or fine-tune a specific model for its own organisation or a specific application can this be departed from. In that case, separate arrangements are made in advance on, among other things, the purpose, the data used and the conditions under which this processing takes place.

Without such an explicit instruction, the principle therefore applies: your data is used to deliver the agreed services, not to train AI models.

Can Nostrion view my clients’ information?

No. Nostrion employees have no access to client data within the Nostrion Platform. This also applies to documents, prompts, entered data and AI output processed within the services.

Based on privacy by design and security by design, our services are set up so that access to client data is limited to what is necessary for the platform to function. Managing the services does not require access to the content of the notarial firm’s client information.

As a result, the content of the information you process with our AI solutions remains shielded from Nostrion employees.

Can a supplier or AI model provider view my clients’ information or use it for its own purposes?

No. Suppliers within our processing chain may process client data exclusively to provide the agreed services. They may not use your clients’ information, documents, prompts or AI output for their own purposes, including training or improving AI models.

We build on open-weight models by choice, and every model we use is hosted within our sovereign European processing chain. Your clients’ information is therefore never sent to the model’s developer.

Based on our principle of sovereignty by design, we also set requirements for the entire processing chain: client data is processed exclusively within EU-hosted and EU-owned infrastructure and not via systems that fall under non-European jurisdiction.

These principles are taken into account in our supplier assessments and contractual arrangements. As a result, even when external technology is used, control over your clients’ information remains within the European processing chain.

Where is my clients’ information processed and stored?

Your clients’ information within the Nostrion Platform is processed and stored exclusively within the European Union. This applies to the entire processing chain in which client data is processed.

Based on our principle of sovereignty by design, we look not only at the physical location of the infrastructure, but also at the ownership and jurisdiction of the suppliers involved. The infrastructure on which client data is processed is EU-hosted and EU-owned.

Client data is not processed via systems that fall under non-European jurisdiction. This prevents your clients’ information within our AI services from becoming subject to, for example, US legislation such as the CLOUD Act.

In this way, we combine European data storage and processing with European control over the entire processing chain.

What happens to my information after I have used AI?

That depends on the functionality used. Nostrion does not retain client data for longer than necessary for the purpose for which it is processed within the services.

Some functionality processes information exclusively to carry out the task in question, while other functionality stores data temporarily, for example to keep conversations, transcriptions or generated results available for a certain period.

Retention periods have been set for each category of data. After the applicable retention period has expired, the data is deleted in accordance with the processes we have set up for this.

An up-to-date overview of the various data categories and associated periods is available in the Trust Center under Retention periods.

Who is responsible for the output that AI generates?

Nostrion is responsible for the operation and control of our AI services. We develop, test, monitor and manage our AI solutions within our ISO 42001-certified AIMS.

Within our services, AI output is intended to support the user. Our AI solutions do not take autonomous professional decisions without human intervention.

The notary remains responsible for the professional assessment and use of the AI output within the specific notarial practice. Nostrion does not take over that professional responsibility.

The division of responsibilities is therefore clear: Nostrion controls the AI services; the notary retains direction over the professional application of the output.

Can AI take decisions or perform actions independently?

No. Human control is a fundamental principle of our AI services. AI supports the user in their work, but within our services does not take autonomous professional decisions without human intervention.

This principle is safeguarded within our ISO 42001-certified AIMS and is taken into account in the design, development and assessment of AI solutions.

For notarial practice, this means that AI can, for example, support the analysis, structuring, summarising or generation of information, while professional assessment and direction remain with the notary.

AI is therefore a tool within the work process and not a replacement for professional decision-making by the notary.

How does the notary remain in control when using AI?

Our AI solutions are designed based on the principle of human oversight. AI supports work and provides information, analyses or proposals, but the user retains control over what happens with that output.

Within our ISO 42001-certified AIMS, human control is taken into account in the design, development, assessment and monitoring of AI solutions. We assess, among other things, the intended application, the possible impact of AI output and the way in which human control is maintained within the application.

The notary can therefore use AI as support within the work process, while professional assessment, decision-making and direction remain with the notary.

How does Nostrion deal with errors, hallucinations or other incorrect AI output?

AI models can generate incorrect, incomplete or unexpected output. We therefore treat this as a structural AI risk and not as something that can be ruled out entirely.

Within our ISO 42001-certified AIMS, AI solutions are assessed and tested before they are put into use and when significant changes are made. We look, among other things, at the quality and reliability of the output. We also continue to monitor and evaluate the operation of our AI solutions after they are put into use.

Signals from use, including user feedback, incidents and anomalous output, can prompt further investigation, additional control measures or adjustment of the AI solution.

At the same time, human oversight remains essential. AI output is supportive and is not regarded as an autonomous professional judgement. In this way, we combine technical and organisational control with human assessment of the final application.

Which AI models are used within the services?

Nostrion uses various AI models, depending on the application. For example, different models may be used for text generation, document analysis, information extraction and speech-to-text.

We use a controlled range of models and build on open-weight models by choice. Which models are used can change over time, because we continuously assess which models best fit the required functionality, quality, security and controllability.

Every model we use is hosted within our sovereign European processing chain. Client data is never sent to the model’s developer.

Because the model landscape changes rapidly, we do not publish a static list of models in this FAQ. Clients can request information from us about the current models used within our services.

How does Nostrion determine which AI model is used for a particular application?

The choice of an AI model is determined by the intended application and the requirements it places on the model. After all, not every model is equally suited to every task.

In selection and assessment, we look, among other things, at the quality and reliability of the output, suitability for the specific application, controllability, security and relevant risks. Before being put into use, the model is tested and evaluated within the application in question.

Model choice is not a one-off decision. Within our ISO 42001-certified AIMS, we continue to monitor the performance and risks of our AI solutions. When another model demonstrably fits the application better, the model used may be changed.

As a result, we do not choose models solely on the basis of technical capabilities, but on the basis of their suitability within the specific application and our requirements for responsible and controlled AI.

Can the AI model used change during the provision of the services?

Yes. The AI landscape is developing rapidly, so the model used for a particular functionality may change during the provision of the services. Within Nostrion, a model change is treated as a controlled change and not merely as a technical replacement.

Within our ISO 42001-certified AIMS, for relevant model changes we assess, among other things, the consequences for the operation of the application, the quality and reliability of the output and any new or changed AI risks.

A new model is assessed and tested before it is deployed within the application in question. We also continue to monitor and evaluate its operation after it is put into use.

In this way, we can benefit from developments in AI technology, while quality, security and control remain paramount in model changes.

How does Nostrion monitor the quality and reliability of AI solutions?

Quality and reliability are monitored throughout the entire lifecycle of our AI solutions. New AI solutions and significant changes are tested and evaluated before being put into use for, among other things, the quality and reliability of the output, explainability and possible bias.

We also continue to monitor and evaluate our AI solutions after they are put into use. We look out for, among other things, deviations in output, signs of bias and model drift.

Findings from monitoring, user feedback and incidents can prompt a reassessment of an application and, where necessary, the implementation of additional control measures or changes.

This way of working is structurally safeguarded within our ISO 42001-certified AIMS. As a result, we do not regard quality and reliability as a one-off test before being put into use, but as a continuous process of testing, monitoring, evaluating and improving.

How does Nostrion deal with new risks or developments around AI?

AI technology, models and laws and regulations are constantly evolving. That is why AI risks within Nostrion are assessed on an ongoing basis and re-evaluated periodically.

Within our ISO 42001-certified AIMS, we assess risks, among other things, for new AI systems and applications, significant changes and changes in the models or suppliers used. Incidents, monitoring results and external developments can also prompt a new assessment.

We look, among other things, at risks relating to privacy, security, bias, transparency and explainability, reliability, model drift, misuse and dependencies on suppliers and foundation models. Where new or changed risks are identified, appropriate control measures are determined and followed up.

Developments in relevant laws and regulations, including the EU AI Act, are also monitored. Where these have consequences for our services, governance or control measures, they are incorporated within the AIMS.

As a result, AI risk management is not a one-off assessment when a solution is introduced, but a continuous part of the management and further development of our AI services.

What information is available for the notarial firm’s own risk, privacy or supplier assessment?

Nostrion makes information available that enables notarial firms to carry out their own risk, privacy, security and supplier assessments.

Our Trust Center provides information on, among other things, our ISO 27001, NEN 7510 and ISO 42001 certifications, the associated Statements of Applicability, our ISMS and AIMS, data sovereignty, data processing, retention periods, the supplier chain and the security and governance of our AI services.

For the notarial sector, a comprehensive GIN assessment is also available, in which we explain for each control measure how Nostrion addresses it within our services.

If additional information is needed for an assessment, clients can request it from us. Where possible, we make additional documentation or explanation available, so that the notarial firm can independently carry out the assessment necessary for its own organisation.

Can Nostrion support you in carrying out a DPIA?

Yes. When a notarial firm, as controller, determines for what purpose and in what way our AI solution is used, the responsibility for carrying out any Data Protection Impact Assessment (DPIA) lies with the notarial firm.

Nostrion supports clients in this with our DPIA Self-Start. This document contains information about our services that can be used as a basis for your own DPIA, including relevant information about the processing and the technical and organisational measures taken.

If additional information or support is needed, we are available to support the notarial firm further.

The final assessment of and responsibility for the DPIA remain with the notarial firm as controller.

How does Nostrion support AI literacy within the notarial firm?

Responsible use of AI requires a good interplay between people, process and technology. Technology can be set up in a controlled and secure way, but responsible use only arises when users understand how AI works and the application is properly embedded in work processes.

That is why we pay attention to AI literacy and awareness within our services. Users must understand, as appropriate to their role, what AI can do, where its limitations lie and what risks are associated with its use. This includes risks such as incorrect or incomplete output and bias, the responsible handling of information and the importance of human judgement.

At the same time, we look at the processes in which AI is applied and at the technological control measures that support responsible use. These include human control, security, privacy, transparency and the control and monitoring of AI risks.

Based on that triangle of people, process and technology, we support notarial firms in using AI consciously and responsibly. Nostrion takes care of the control of our AI services and supports knowledge and awareness among users; the notarial firm itself decides how AI is used within its own organisation and work processes.