Skip to content

Security and privacy

Security and privacy

Your client wants a DPIA, your AEO file needs a supplier assessment, and your own security officer sends a four page questionnaire. This page sets out what SKAI does with your data, where it sits, who can reach it and what is not there.

Security and privacy

Built for a DPIA, not for a brochure.

Your client wants a supplier assessment. This is what SKAI does with your data, and what is not there.

  • AI

    TrainingNever
    Isolatie
    Audit

    Not used for training

    Your customs data is not used for training in any form. The model reads documents. The declaration comes from rules.

  • Declarant

    IMA 2026-04281 klaar voor indiening.

    Goedkeuring vereist.

    GoedkeurenAfwijzen

    Separated per organisation

    Every record belongs to one organisation. Rights per role, and inside that per principal.

  • HMRC

    OAuth 2.0

    ••••••

    Douane

    IPsec

    ••••••

    Anthropic

    API-sleutel

    ••••••

    Encrypted in transit and at rest

    TLS everywhere. AES-256 on the database, files and backups. Integration tokens encrypted outside the database.

For your questionnaire

What we record. And what we do not claim.

These answers sit in the DPIA Louvels.dev gives procurement teams. An auditor may check them.

  • GDPR

    You are the controller

    For declaration and shipment data. Louvels.dev is the processor and acts only on your instruction.

  • EU

    Azure West Europe

    Application, database, files and backups stay in that region. No UK instance, no customer-specific region.

  • Log

    Full audit trail

    What, by whom, when. Every customs message in and out. Every AI extraction traced back to the source document.

  • SSO

    Sign-in through Entra ID

    SKAI authenticates against your Microsoft tenant. Your MFA, groups and leavers then apply to SKAI as well.

  • 24h

    Breach notification

    Within 24 hours of becoming aware, by the named security contact, with the facts known at that moment.

  • No

    No ISO 27001 or SOC 2 of SKAI

    No certificate of our own, no pentest report. Azure underneath does. What SKAI itself does is above.

Access

Who may see what

Least privilege per action, not only per screen. For a larger organisation, SSO answers most of the questionnaire.

  • Roles per organisation

    A declarant only sees the principals you assign. API keys per organisation, which you can revoke.

  • Single sign-on

    The customer's Microsoft Entra ID. Conditional access, groups and joiner-mover-leaver travel with it.

  • MFA where it counts

    On for Azure admin accounts. SKAI does not enforce MFA on local accounts. That is why SSO.

Encryption

In transit, at rest, on keys

The hosting layer is Azure. On top of that SKAI encrypts integration credentials itself, with a key outside the database.

  • In transit

    TLS everywhere. HTTPS-only on API and portal. HMRC over TLS and OAuth 2.0. Dutch customs gateway through a dedicated IPsec tunnel.

  • At rest

    Database, files and backups with AES-256. Backups for seven days, same region, never selectively edited.

  • Integration keys

    HMRC tokens, AI key and mailbox tokens encrypted with XSalsa20-Poly1305. Passwords only as salted hashes.

  • Audit trail

    Changes per object, every API request, every customs message including payload and error codes. Export per declaration, period or user.

Ask for the data processing agreement, the sub-processor list and the data flow diagram for your own channels during a thirty minute demo.

Your client wants a DPIA, your AEO file needs a supplier assessment, and your own security officer sends a four page questionnaire. This page sets out what SKAI does with your data, where it sits, who can reach it and what is not there.

Book a demo