Trust & Assurance

Regulatory compliance.

How the company and the platform stand against the standards institutions ask about — including the ones that have not been assessed or certified.

Where ARETE stands

ARETE Strategy AI Ltd is a technology and advisory company incorporated in the Republic of Cyprus. It is not a regulated financial institution, a law firm, an audit or assurance practice, or a supervisory authority, and it does not provide legal, regulatory or audit opinions. No regulator has approved, endorsed or certified the platform, and platform output does not establish that an organisation is compliant.

Standard	Status	What stands today	What remains
EU General Data Protection Regulation Regulation (EU) 2016/679 · Cyprus is an EU member state Privacy notice →	Pending legal review	Processing is confined to business contact details, institutional records and platform content. Tenant data is organisation-scoped, evidence files are private, and material operations are audited. Personal data is not sold, profiled for advertising or transferred for marketing purposes.	·The privacy notice and cookie notice are published as drafts and require verification against the site's actual data flows, connected services and retention. ·Records of processing, a retention schedule, processor agreements and a sub-processor register remain to be completed. ·A designated privacy contact and the international transfer position must be confirmed before the notices are finalised.
Cyprus company and commercial law Companies Law, Cap. 113 Corporate information →	Registered	ARETE Strategy AI Ltd is incorporated in the Republic of Cyprus under company number HE 487713, with a registered office in Nicosia, a recorded director and an appointed company secretary through which statutory filings are maintained.	·Governing-law and contractual terms for engagements remain subject to review by Cyprus-qualified counsel.
EU Artificial Intelligence Act Regulation (EU) 2024/1689 AI transparency notice →	Applicability pending	The AI features are assistive: every run is persisted with its provenance, assumptions and uncertainty, a human reviewer must approve any output before it affects a downstream record, approval independence is enforced, and a fallback fixture can never be approved.	·Which transparency and documentation obligations apply depends on the deployed configuration and its use, and must be determined before the transparency notice is finalised. ·No conformity assessment has been performed and none is claimed; the platform is not presented as a high-risk AI system.
Digital Operational Resilience Act Regulation (EU) 2022/2554	Aligned — not certified	The platform's constructs map to the ICT risk themes an in-scope client must evidence: a durable audit trail, an integration registry recording scope, classification and quarantine or revocation, scheduled operational tasks, and notification records for assignment, escalation and review outcomes.	·No independent DORA assessment has been performed, and ARETE does not claim DORA certification — none exists. ·Contractual provisions, the register of information for ICT third-party arrangements and resilience-testing evidence have not been produced. ·ARETE is a technology and advisory provider to in-scope entities; it is not itself a supervised financial entity.
NIS2 Directive Directive (EU) 2022/2555	Applicability pending	Supply-chain and incident-reporting duties that in-scope clients owe their own suppliers are the duties ARETE intends to be able to answer, on the basis of the controls and disclosures published on this page.	·Whether the company falls within the directive's scope, and the resulting security and reporting obligations, requires determination with counsel. ·A documented incident-response and client-notification procedure has not been published.
ISO/IEC 27001 Information security management Security standards →	Aligned — not certified	Information-security controls are organised around the standard's themes: access control, tenant and evidence classification, logging and monitoring, supplier relationships, incident handling and change control — as detailed on the Security standards page.	·No certification audit has been performed and no certificate is held or claimed. ·No ISMS scope statement, statement of applicability or internal audit programme has been published. ·Independent assurance would require retained evidence and an accredited auditor.
SOC 2 Trust services criteria report	Not claimed	Where a procurement process requires a SOC 2 report, ARETE responds with the control evidence behind each status on this page and direct documentation for the client's own assessment.	·No SOC 2 report has been issued by an independent auditor, and none is claimed. ·No bridge letter, control matrix from an auditor or penetration-test report exists to offer.

A framework appears here only where ARETE can state its position against it. Absence of an entry is not a statement about that framework; institutions with additional requirements should raise them through due diligence and they will be answered against the evidence held.

Certifications

No information-security certification is claimed. ARETE Strategy AI Ltd does not hold ISO/IEC 27001 certification, has not issued a SOC 2 report and has not been assessed by an independent assurance provider. Where an institution requires independent assurance, the control evidence behind each status on this page is made available for its own review.

Reporting a security concern

Security concerns, vulnerability reports and institutional due-diligence requests are directed to the security contact address and acknowledged by the company. Write to admin@aretestrategyai.org.