Last updated: August 13, 2026. This page details Spctre's support for the General Data Protection Regulation (GDPR) and the European Union Artificial Intelligence Act (EU AI Act).
Under the GDPR, Ciwrl Technologies LLC d/b/a Spctre serves primarily as a Data Processor on behalf of our customers (the Data Controllers). We process agent telemetry, environment metadata, and policy evaluation results solely under the instruction of the controller:
We process the telemetry, resource scopes, and policy data a controller configures to verify and audit agent execution. Generic evidence integrations retain submitted source records alongside canonical evidence, so controllers should apply redaction and limit active telemetry to non-PII values before submission.
Customer workspaces are logically separated at the database level. Tenant context and row-level security (RLS) policies scope data access to the active workspace during runtime gateway evaluations.
We maintain a public directory of third-party sub-processors (e.g., Paddle for payments and tax, Google Cloud for application hosting and data storage through Cloud Run and Cloud SQL, and Cloudflare for edge delivery) engaged under strict Data Processing Agreements (DPAs) incorporating EU Standard Contractual Clauses (SCCs).
GDPR Article 22 places restrictions on purely automated decision-making that affects natural persons. If your autonomous agents execute decisions that affect individuals, Spctre is engineered to supply the necessary explainability framework:
For each action evaluated by Spctre, the record can include the specific policy rule, matching condition, and decision reason (e.g., refund.limit_exceeded). This gives compliance officers a human-readable justification for governed automated actions.
Governed decisions retain a hash reference (SHA-256) to the active policy bundle. This lets reviewers retrieve and inspect the rules in force for that decision during an audit.
When an agent action is routed to a human reviewer, the control plane logs the reviewer's identity, the approval/denial timestamp, and the explicit rationale entered during manual resolution.
Spctre SDKs integrate customizable regex parameters. You can intercept tool arguments and runtime targets at your cluster border, masking personal identifiers before they ever reach our hosted gateways.
To fulfill GDPR Article 17 (Right to Erasure), administrators can initiate target erasure requests via our API, identifying and deleting specific traces containing transient personal markers.
Audit logging balances erasure with ledger integrity. Deletion operations overwrite parameter metadata while leaving transaction hashes and state signatures intact to preserve overall ledger history.
The EU AI Act mandates stringent controls for high-risk AI and governed AI agent systems. Spctre is designed as a foundational compliance tool to help developers fulfill these legal obligations:
Our simulation projections let developers test proposed policy rules against real historical logs. This satisfies AI Act requirements to evaluate risks, systemic biases, and failure modes before deploying AI systems.
Spctre automatically generates chronological logs of system operations throughout the life cycle, providing the durable, audit-verifiable proof of AI decisions required by European regulators.
By separating system rules into inspectable bundles and mapping all runtime targets into normalized schemas, Spctre ensures system operations remain transparent, predictable, and inspectable.
Our REVIEW gate allows developers to build programmatic human-in-the-loop overrides, pausing autonomous tool execution until approved by a qualified operator.