Security and responsibility
How the server is built, what the law asks and how we answer it. And what we don’t do.
How we build
Every software image that goes on the server is checked for known vulnerabilities before delivery, and images are updated to fixed versions.
Every build produces a bill of materials (SBOM). It is read from the finished software image, not only from dependency declarations, so it lists what actually goes into the delivery.
| Finding | What happens |
|---|---|
| A vulnerability known to be exploited (CISA KEV catalogue) | Never shipped. The image is fixed or left out of the delivery. |
| A critical-severity vulnerability with a fix available | Not shipped. The image is updated to the fixed version. |
| A high-severity vulnerability with a fix available | Listed in the release notes, so you can see it. |
What the law asks and how we answer
AI Act
Under the EU AI Act, Tokeno is the provider of the AI system.
Cyber Resilience Act (CRA)
Under the Cyber Resilience Act, Tokeno is the manufacturer of the product. Its reporting obligations have applied since 11 September 2026, and its other requirements apply from 11 December 2027.
General Data Protection Regulation (GDPR)
When we have access to your system, we act as a processor and you are the controller. The responsibilities are agreed in writing before delivery.
We use no sub-processors, and data is not transferred outside your own network.
Your own obligations
We go through your organisation’s own obligations with you at the start, such as those under section 5 of the Act on Information Management in Public Administration (906/2019) and the Act on the Provision of Digital Services (306/2019).
What we don’t do
- We don’t present open source components as our own development work.
- We don’t keep the administrator credentials to ourselves.
- We don’t build undocumented dependencies that require us.
- We don’t send usage data from the server anywhere.
- We don’t claim the server cannot be broken into. Nobody can promise that.
- We don’t promise a particular language model. We promise the best model that fits the size class you bought, and under the service agreement we keep it current.
Get in touch.
We’ll tell you which configuration fits your use and what the delivery includes.
Phone: +358 44 973 8676