How EHForder stays compliant.

EHForder is built for European procurement teams operating under strict commercial, data-protection, and audit regimes. Compliance isn't a separate workstream — it's baked into the product.

GDPR & data residency

All production data is stored and processed within the European Economic Area. Heroku hosts the application and managed AI inference in the EU; AWS hosts email and document storage in Frankfurt / Ireland; efacto's Peppol Access Point operates from the EU. No data leaves Europe in the normal course of operating the Service.

Our role is data processor for the purchase-order content received on behalf of each Customer, and data controller for user accounts, audit logs, and billing data. The terms governing both roles are set out in our Privacy Policy and DPA.

Lawful basis: contract performance for delivering the Service, and legitimate interest for security, fraud prevention, and audit. We don't run third-party trackers, analytics, or advertising.

Norwegian bokføringsloven

EHForder retains source documents — raw inbound .eml files and the generated EHF XML — for 7 years by default. This matches the retention requirement under bokføringsloven §13 for commercial-flow source records. Customers in jurisdictions with longer retention requirements can extend the default; shorter retention is not offered for source documents during the statutory window.

EU AI Act

EHForder's AI-assisted order extraction with mandatory human review falls within the "limited risk" category under the EU AI Act (Regulation 2024/1689). Specifically:

• Human-in-the-loop is the default. Every order goes to a Reviewer at the Customer for approval unless the Customer has explicitly enabled auto-approval and the order meets the Customer's configured confidence threshold and safety caps.
• Auto-approval is opt-in per Customer. A Calibration mode checkbox in the Customer's AI threshold settings sends every order to the Reviewer regardless of score — recommended for the onboarding period and any time the Customer wants a manual pass.
• Hard caps prevent auto-approval where any single field has low confidence, where any line is unmatched against the catalogue, where the order value exceeds a Customer-configured ceiling, or where a Sender has been newly added.
• Every extraction is logged with field-level confidence scores, the model and prompt version used, and the resolved order — so any incorrect extraction can be root-caused after the fact.

AI providers used: Anthropic Claude (Haiku for classification, Sonnet for structured extraction), accessed exclusively via Heroku's EU-resident managed-inference endpoints. No order data is sent to non-EU inference.

Peppol

Transmission of EHF Order documents over Peppol is handled via efacto, our Peppol Access Point partner. EHForder generates EHF Ordre 3.0 / Peppol BIS Order 3.0 documents that are schematron-validated against the OpenPEPPOL 2024.11 ruleset before transmission — receivers never reject our documents on formatting grounds.

Three-tier corrections are supported per Peppol BIS: Order Change (Tier 1), Order Cancellation (Tier 2), and Order Replacement (Tier 3), gracefully degrading to the highest tier each individual recipient accepts.

Security

• Passwordless authentication via one-time email tokens. No password database, no credential-stuffing exposure.
• TOTP secrets encrypted at rest with AES-256 via Rails 8 active_record_encryption.
• TLS 1.2+ in transit, HSTS on all responses, strict CSP, X-Frame-Options DENY.
• Strict tenant isolation in the database; every tenant query is scoped, every admin page guards against cross-tenant data leaks.
• Audit logging on every state-changing action — who edited what, when, from where, with before/after diffs.
• Continuous Heroku Postgres backups; documented restore procedure exercised before every new Customer onboarding.

Sub-processors

We engage the following sub-processors, all bound by data processing agreements equivalent to those we offer Customers, and all processing data within the EU/EEA:

• Heroku (Salesforce) — application hosting + EU-resident managed AI inference.
• Amazon Web Services — inbound email ingestion (SES), attachment + XML storage (S3), and transactional email delivery (SES SMTP). EU regions only.
• efacto — Peppol Access Point for AS4 transmission.
• Anthropic (via Heroku managed inference) — language-model inference for classification and extraction, EU endpoints only.
• PayoutPartner (Skiwo product) — billing and invoicing.

Contact

Compliance, security, or DPO enquiries: privacy@ehforder.com. Written queries: Skiwo AS, Pilestredet 17, 0164 Oslo, Norway.