Faurenis
Trust Centre

One page for your DPO's questions.

Every document a clinical-software buyer asks us for — in one place, with a clear path to request the artefact.

Request documentsSee compliance matrix

Compliance artefacts you can request

Data Processing Agreement (DPA)

Our standard DPA tailored for EU and US clinic deployments. Includes SCCs where transfers apply.

Available on request Request

Sub-processor list

Every third party that processes Faurenis data — region, data scope, contractual basis. 30 days notice on changes.

Updated 2026-05-15 Request

Penetration test summary

Latest annual independent pen-test. Critical findings remediated and re-tested before release.

Under NDA Request

Compliance matrix

  • GDPR (EU)

    Implemented
    What it means
    EU framework covering personal-data processing — lawful basis, minimisation, transfers, rights.
    Faurenis
    EU residency by default for EU tenants. DPA on request. Data-subject access export at any time. Sub-processor list published with 30 days notice on changes.
    Owner
    Security & Compliance

  • HIPAA-style controls (US)

    Implemented
    What it means
    US framework for protected health information — administrative, physical, and technical safeguards.
    Faurenis
    Encryption at rest and in transit. Role-based access controls. Audit logging with 7-year retention. BAAs signed with US clinics. HIPAA does not certify products; we sign the agreements that align Faurenis with the safeguard requirements.
    Owner
    Security & Compliance

  • EU AI Act

    Readiness pathway
    What it means
    EU framework treating AI in medical contexts as high-risk — requires QMS, transparency, oversight, accuracy logging.
    Faurenis
    Designed for the Act's high-risk obligations: badged AI outputs, validation queue, accuracy logging, audit trail. Faurenis will not claim "compliant" until the certification pathway is fully formed.
    Owner
    Security & Compliance

  • MDR (EU)

    Requires legal validation
    What it means
    EU medical device regulation — applies if software is classified as a medical device.
    Faurenis
    Faurenis provides AI-assisted documentation and workflow support; no AI output becomes part of the official record without clinician acceptance. Its MDR status is not self-declared: intended use and classification remain subject to qualified legal and regulatory review.
    Owner
    Security & Compliance

  • SOC 2 Type II

    In progress
    What it means
    US audit framework covering security, availability, processing integrity, confidentiality, and privacy.
    Faurenis
    Type I report available on request. Type II in progress — audit window open, report expected within the year.
    Owner
    Security & Compliance

  • ISO/IEC 27001

    Readiness pathway
    What it means
    International information-security management standard.
    Faurenis
    On the readiness pathway. Gap analysis complete; certification audit scheduled.
    Owner
    Security & Compliance

  • NIS2 (EU)

    Requires legal validation
    What it means
    EU directive on network and information security for essential and important entities.
    Faurenis
    NIS2 applicability to dental clinics varies by member state. Faurenis publishes the controls clinics can rely on to demonstrate their own NIS2 posture; clinic-side classification requires legal advice.
    Owner
    Security & Compliance

  • Croatian Personal Data Protection

    Implemented
    What it means
    National implementation of GDPR with Croatian-specific procedural requirements.
    Faurenis
    Faurenis supports Croatian-language consent forms, EU residency by default, and the procedural workflow Croatian DPOs typically require.
    Owner
    Security & Compliance

  • Audit log retention

    Implemented
    What it means
    Long-tail retention for clinical and access audit events to satisfy regulatory minimums.
    Faurenis
    Audit logs retained for 7 years. Append-only storage. Per-record integrity hashes. Exportable as JSON for SOC 2 evidence.
    Owner
    Engineering

  • Penetration testing

    Implemented
    What it means
    Independent security testing to identify exploitable vulnerabilities.
    Faurenis
    Annual independent penetration test. Summary report available under NDA from the Trust Centre. Critical findings are remediated and re-tested before the next release.
    Owner
    Security & Compliance

  • UAE Data Protection (PDPL / DHA / DOH / MOHAP)

    Planned
    What it means
    UAE federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), plus emirate-level healthcare-data rules from the Dubai Health Authority, the Department of Health – Abu Dhabi, and the Ministry of Health and Prevention, and separate DIFC/ADGM free-zone data protection regimes.
    Faurenis
    Not yet supported. Faurenis is EU-hosted today, no UAE region is provisioned, and UAE-qualified legal counsel has not yet been engaged. UAE health-data residency requirements are unconfirmed. No UAE deployment or compliance claim is made until that engagement and review conclude.
    Owner
    Security & Compliance

Faurenis is designed to support these frameworks through configurable controls, audit-ready workflows, and human-in-the-loop AI design. Certification pathways and market-specific claims require legal and regulatory validation before being relied upon. This matrix is not legal advice.

How we publish changes

Sub-processor changes get 30 days notice on the Trust Centre and via email to your admin contact. Material changes to data handling are notified 60 days in advance with an annotated changelog.

Operational changes that do not affect your data handling (engine updates, performance improvements) are notified in the monthly product update.

See live status
Talk to security

One call, every document.

Schedule with the security and compliance lead. We bring the artefacts; you bring the questions.

Contact security teamRead compliance overview