Question 1

Does CRP Comply replace a notified body or legal counsel?

Accepted Answer

No. CRP Comply produces drafts, evidence maps, and tamper-evident logs. It is decision-support tooling and does not replace legal opinions, third-party conformity assessments, or notified-body certification.

Question 2

Which regulations does CRP Comply cover?

Accepted Answer

EU AI Act (Regulation 2024/1689), ISO/IEC 42001, ISO/IEC 23894, NIST AI RMF and its Generative AI profile, GDPR including DPIA, the Council of Europe AI Framework Convention, and the OECD AI Principles.

Question 3

What is bring-your-own-key (BYOK)?

Accepted Answer

You configure your own LLM provider (OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, or a self-hosted endpoint). CRP Comply routes prompts to that provider under your contract and never uses your data to train models. Provider keys are encrypted at rest with AES-256-GCM.

Question 4

Where is my data stored?

Accepted Answer

On Railway in the region you select. Off-site disaster-recovery backups are pushed nightly to Cloudflare R2 with a 60-day rolling retention window. See the Privacy Policy for the full sub-processor list.