Executive Security Commitment: Eyan Innovations adheres to a strict Zero-Knowledge, Ephemeral Architecture. We do not store citizen tax records, personal identity numbers, or voice recordings. Public agencies remain 100% in control as Data Controllers (*Personuppgiftsansvariga*), with all compute operating on sovereign European Union infrastructure.
🛡️
Zero Data Retention
Stateless in-memory RAM processing. Audio buffers and session context are cryptographically purged upon call hangup.
🇪🇺
100% EU Data Sovereignty
Hosted strictly within EU data centers (Stockholm/Frankfurt). Fully immune to the US CLOUD Act and Schrems II risks.
🔒
End-to-End Encryption
TLS 1.3 for API webhooks, SRTP (Secure Real-Time Protocol) for audio streams, and AES-256 data protection.
1. Technical Data Flow & Privacy Safeguards
Inaaya functions as an intelligent audio conduit between the citizen's telephone and the public authority's existing switchboard:
| Data Layer |
Protocol / Standard |
Retention Policy |
Compliance Status |
| Voice Audio Stream |
SRTP / SIP TLS |
0 seconds (Purged from RAM upon call termination) |
Compliant |
| Citizen Identity / BankID |
mTLS 1.3 via certified broker (Criipto/Signicat) |
Ephemeral token verification; 0 credentials stored |
Zero-Trust |
| Case Data & Transcripts |
HTTPS REST API / Webhooks |
Pushed directly to Agency CRM; 0 copies retained by Eyan |
Controller-Owned |
| PII Masking |
Automated real-time regex redaction |
Personnummer & phone numbers masked in transit (`1985****-****`) |
Privacy by Design |
2. Swedish Public Sector Legal Compliance
- GDPR Article 28 (PUB-avtal): Eyan Innovations enters into standard Swedish Data Processing Agreements (*Personuppgiftsbiträdesavtal*) based on Integritetsskyddsmyndigheten (IMY) and SKR guidelines. The public agency remains the sole **Personuppgiftsansvarig**.
- Swedish Secrecy Act (OSL 2009:400): Operational processes comply with statutory confidentiality obligations under **Offentlighets- och sekretesslagen Kap. 27 (*Skattesekretess*)** and Kap. 10.
- eSam Guidelines (*eSamverkan för offentlig sektor*): Cloud infrastructure adheres strictly to eSam's published criteria regarding digital sovereignty and legal access controls for Swedish public authorities.
- Zero Commercial Training: Contractual guarantee that citizen voice data or public agency records will **never be shared, sold, or used to train public commercial LLMs**.
3. Immediate Verification & Audit Options for Agency CISOs
We provide prospective public sector partners with 3 immediate verification pathways:
- Synthetic Sandbox Pilot: We connect Inaaya to the agency's staging API using official synthetic test citizen numbers (`19800101-9999`), enabling complete end-to-end packet inspection with **zero exposure of real citizen data**.
- Live CISO Network Inspection: A structured 20-minute technical walkthrough allowing agency IT architects to verify European IP routing, TLS certificates, and live memory purging.
- Independent Third-Party Verification: Scheduled external penetration testing and GDPR compliance review supported through our verification program with **Almi Företagspartner Stockholm**.
Eyan Innovations | Org/Personnr: 890301-4192 | Godkänd för FA-skatt
Live Demo: +1 650 252 7076 | https://eyaninnovations.se