Faurenis
Safety & Compliance

Word discipline as a regulatory posture.

We say 'implemented' when a control is live. 'Readiness pathway' when we are pursuing certification. 'Designed to support' when the framework does not certify products. We do not say 'compliant' without naming the body and the audit date.

Open the Trust CentreRead the FAQ

Compliance readiness matrix

  • GDPR (EU)

    Implemented
    What it means
    EU framework covering personal-data processing — lawful basis, minimisation, transfers, rights.
    Faurenis
    EU residency by default for EU tenants. DPA on request. Data-subject access export at any time. Sub-processor list published with 30 days notice on changes.
    Owner
    Security & Compliance

  • HIPAA-style controls (US)

    Implemented
    What it means
    US framework for protected health information — administrative, physical, and technical safeguards.
    Faurenis
    Encryption at rest and in transit. Role-based access controls. Audit logging with 7-year retention. BAAs signed with US clinics. HIPAA does not certify products; we sign the agreements that align Faurenis with the safeguard requirements.
    Owner
    Security & Compliance

  • EU AI Act

    Readiness pathway
    What it means
    EU framework treating AI in medical contexts as high-risk — requires QMS, transparency, oversight, accuracy logging.
    Faurenis
    Designed for the Act's high-risk obligations: badged AI outputs, validation queue, accuracy logging, audit trail. Faurenis will not claim "compliant" until the certification pathway is fully formed.
    Owner
    Security & Compliance

  • MDR (EU)

    Requires legal validation
    What it means
    EU medical device regulation — applies if software is classified as a medical device.
    Faurenis
    Faurenis provides AI-assisted documentation and workflow support; no AI output becomes part of the official record without clinician acceptance. Its MDR status is not self-declared: intended use and classification remain subject to qualified legal and regulatory review.
    Owner
    Security & Compliance

  • SOC 2 Type II

    In progress
    What it means
    US audit framework covering security, availability, processing integrity, confidentiality, and privacy.
    Faurenis
    Type I report available on request. Type II in progress — audit window open, report expected within the year.
    Owner
    Security & Compliance

  • ISO/IEC 27001

    Readiness pathway
    What it means
    International information-security management standard.
    Faurenis
    On the readiness pathway. Gap analysis complete; certification audit scheduled.
    Owner
    Security & Compliance

  • NIS2 (EU)

    Requires legal validation
    What it means
    EU directive on network and information security for essential and important entities.
    Faurenis
    NIS2 applicability to dental clinics varies by member state. Faurenis publishes the controls clinics can rely on to demonstrate their own NIS2 posture; clinic-side classification requires legal advice.
    Owner
    Security & Compliance

  • Croatian Personal Data Protection

    Implemented
    What it means
    National implementation of GDPR with Croatian-specific procedural requirements.
    Faurenis
    Faurenis supports Croatian-language consent forms, EU residency by default, and the procedural workflow Croatian DPOs typically require.
    Owner
    Security & Compliance

  • Audit log retention

    Implemented
    What it means
    Long-tail retention for clinical and access audit events to satisfy regulatory minimums.
    Faurenis
    Audit logs retained for 7 years. Append-only storage. Per-record integrity hashes. Exportable as JSON for SOC 2 evidence.
    Owner
    Engineering

  • Penetration testing

    Implemented
    What it means
    Independent security testing to identify exploitable vulnerabilities.
    Faurenis
    Annual independent penetration test. Summary report available under NDA from the Trust Centre. Critical findings are remediated and re-tested before the next release.
    Owner
    Security & Compliance

  • UAE Data Protection (PDPL / DHA / DOH / MOHAP)

    Planned
    What it means
    UAE federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), plus emirate-level healthcare-data rules from the Dubai Health Authority, the Department of Health – Abu Dhabi, and the Ministry of Health and Prevention, and separate DIFC/ADGM free-zone data protection regimes.
    Faurenis
    Not yet supported. Faurenis is EU-hosted today, no UAE region is provisioned, and UAE-qualified legal counsel has not yet been engaged. UAE health-data residency requirements are unconfirmed. No UAE deployment or compliance claim is made until that engagement and review conclude.
    Owner
    Security & Compliance

Faurenis is designed to support these frameworks through configurable controls, audit-ready workflows, and human-in-the-loop AI design. Certification pathways and market-specific claims require legal and regulatory validation before being relied upon. This matrix is not legal advice.

Why the words matter

Most compliance frameworks do not certify products. HIPAA does not. GDPR does not. The EU AI Act is on the way but the pathway is not yet final. Some frameworks do certify — ISO 27001, SOC 2 — and we use the words "certified" only where a certification body has issued a report.

The discipline matters because our descriptions of our posture end up inside clinic procurement reviews. When a buyer trusts our description, they should be able to take it at face value.

This matrix is not legal advice. Clinic-side classification under specific national frameworks usually requires legal review with a local DPO.

Compliance documents

Get the DPA, sub-processor list, and pen-test summary.

One email gets you the artefacts your DPO needs. The Trust Centre lists what is on the shelf today.

Contact security teamRead compliance overview