Naslag
DORA
Versie 2.0 · Laatst bijgewerkt 2026-11-03
Dit document is alleen in het Engels beschikbaar. Lees de Engelse versie
Unless is an EU-based ICT service provider that gives financial entities the controls, documentation, and contractual terms they need to keep their conversational AI within DORA requirements.
Where Unless sits under DORA
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) applies to financial entities in the EU since 17 January 2025. It is supervised by the European Supervisory Authorities (EBA, ESMA, and EIOPA) together with national regulators such as the Dutch Central Bank (DNB).
Unless is not a financial entity. Under DORA, Unless is an ICT third-party service provider to its financial customers. The obligations on this page are therefore of two kinds: what Unless does itself to run a resilient service, and what Unless provides so that a financial entity can meet its own obligations, in particular the contractual requirements of Article 30 and the register of information under Article 28.
The public parts of what is stated here can be checked against our vendor assessment, security addendum, data processing addendum, and sub-processor list. Internal evidence is available under NDA.
DORA support at Unless
| Area | What Unless does | What it means for you |
|---|---|---|
| ICT risk management framework | Unless operates an information security management system modelled after ISO 27001 and 27002:2022, with a documented and approved risk management framework. Risks are reassessed on a recurring basis and whenever something material changes, such as a new feature, infrastructure change, or new vendor. Unless does not hold its own ISO 27001 certificate; the cloud infrastructure the service runs on is certified through AWS (ISO/IEC 27001, 27017, 27018), with independent SOC 1, 2, and 3 reports. Unless is preparing for ISO/IEC 42001 certification for AI management systems. | You run on a platform governed by a recognized information security framework, on certified infrastructure, and you can verify both against our published documentation when you assess the provider under Article 28. |
| Incident management and reporting | Unless collects and monitors logs from all key systems, with automated alerting for suspicious activity. A documented incident response plan defines severity levels, escalation paths, roles, and the phases of detection, triage, containment, eradication, recovery, and post-incident review. Personal data breaches are notified within 48 hours under the data processing addendum. Other incidents that may affect your service are reported promptly under the security addendum, with regular updates until resolved. | You receive the information you need to classify and record an ICT-related incident in your own register and to meet the reporting timelines of Article 19. |
| Resilience testing | Automated vulnerability scanning runs continuously in our CI pipeline and through AWS-native security services, with findings tracked by severity and remediated within defined timelines. External penetration tests are commissioned for significant changes and major releases. Business continuity and disaster recovery procedures are documented and restore tests are performed periodically. Threat-led penetration testing (TLPT) under Article 26 is an obligation of the financial entity; Unless cooperates with a customer’s TLPT programme on request, within the terms of the agreement. | You can evidence that your provider tests its own environment, and you can include Unless in your own resilience testing where your supervisor requires it. |
| Contractual arrangements and third-party oversight | Unless provides a transparent service description, a published sub-processor list with twenty business days’ notice of changes and a right to object, a data processing addendum with audit rights, a security addendum, and service levels in the order form. Termination and exit are covered in the terms of service, and customer data is returned or deleted at the end of the agreement. | These elements map to the contractual provisions required by Article 30. On request we provide the entity, location, and sub-processor details you need for your register of information under Article 28. |
| Subcontracting | All sub-processors that may handle end-user personal data process it inside EU regions. The underlying AI models are hosted within those sub-processors’ EU regions. Sub-processors are assessed before onboarding and reviewed periodically, and are contractually bound to materially equivalent security standards. | You have full visibility of the ICT subcontracting chain behind the service, as DORA expects for critical or important functions. |
| Data security and encryption | Customer data is encrypted at rest with AES-256 and in transit with TLS, with keys managed through cloud key management services that enforce restricted access, usage auditing, and rotation. Personal data is filtered and tokenized through the Privacy Vault before the generative model phrases an answer, so the model that phrases the answer never receives a recoverable identifier. | Your conversational AI data is protected in line with DORA and the GDPR, and end-user personal data stays within the EU by design. |
| Governance and oversight | Information security and technical operations are owned by the CTO. Privacy and compliance are owned by the Data Protection Officer. The CEO oversees the information security management system and AI governance. Access rights, third-party service levels, disaster recovery, service continuity, and monitoring are reviewed on a recurring basis by the CTO and recorded in an internal review log. | You deal with named owners for security and privacy, and you can ask for evidence of the review cycle under the audit rights in the agreement. |
| Business continuity | The platform is serverless and runs in AWS Ireland across multiple availability zones. Datastores use managed, replicated services with automatic failover. Continuous point-in-time backups are retained for thirty-five days. Documented recovery objectives and the full continuity plan are available under NDA. | You can assess the provider’s continuity arrangements for the functions you depend on, as required for critical or important functions. |
| Readiness for critical provider designation | Unless is Rocket Launcher B.V., a Dutch company established in the EU. Should Unless ever be designated as a critical ICT third-party service provider under Articles 31 to 44, it will cooperate with the Lead Overseer as the regulation requires. | Your reliance on Unless would not be interrupted by a designation; the provider is already EU-established and within reach of the oversight framework. |
| Threat information | Unless monitors security advisories from its cloud and model providers and from ENISA, and incorporates relevant threats into its risk assessments. When an incident affects a customer, relevant indicators are shared as part of the incident reporting process. | You receive threat information that is relevant to your deployment when it matters, through the incident process rather than ad hoc. |
Documentation for your assessment
- Vendor assessment: our answers to standard due-diligence and security questionnaires
- Security addendum and security overview
- Data processing addendum and sub-processor list
- Data and locations
- EU AI Act compliance
- Certifications
Internal documents such as the incident response plan, the business continuity plan, and penetration test attestations are available under NDA. Contact security@unless.com for security matters and dpo@unless.com for privacy matters.
