§ 01 Finance · Overview
DORA does not regulate us. It regulates you, and then reaches us through the contract you sign. This page sets out what Regulation (EU) 2022/2554 obliges a financial entity to secure from an ICT third-party provider, and states plainly which of those we could sign today and which we could not.
§ 02 Duty · Who DORA binds
DORA has applied since 17 January 2025. It binds financial entities — banks, insurers, investment firms, payment institutions — and it reaches their suppliers only through what those entities are required to put in writing.
This matters when reading any vendor page, including this one. A compute supplier cannot be “DORA compliant” on your behalf, because the compliance duty never sat with the supplier. What a supplier can do is accept the contractual terms your obligations require, and be honest about the ones it cannot yet accept.
| Article | Your duty | What it means for a supplier |
|---|---|---|
| Article 28(3) | Maintain a register of information | Every contractual arrangement for ICT services goes in a register the entity reports to its competent authority, flagged by whether it supports a critical or important function. An AI compute supplier is an entry in that register, not an exception to it. |
| Article 28(8) | Hold an exit strategy | For critical or important functions the entity must be able to leave without disrupting the business or breaching regulatory duties. That obligation is worth more than any assurance a supplier gives about staying. |
| Article 29 | Assess concentration risk before signing | The entity weighs concentration before contracting, including the difficulty of substituting a provider. A supplier arguing it is indispensable is arguing itself into the problem this article was written for. |
| Article 30(2)–(3) | Put specific terms in the contract | Minimum clauses for all arrangements, with a longer list where the service supports a critical or important function. This is the operative article for anyone buying AI compute. |
| Article 31 | Recognise designated critical providers | The ESAs designate critical ICT third-party providers and place them under the Oversight Framework. Designation is a decision of the authorities. No supplier can award it to itself, and no supplier should imply it. |
| Articles 26–27 | Include the provider in resilience testing | Where threat-led penetration testing applies, providers involved in critical functions can be pulled into the scope of the test. A supplier has to be able to say yes to that in writing. |
§ 03 Contract · Article 30(3)
Where an ICT service supports a critical or important function, these terms are not negotiable extras. They are the minimum content of the contract.
| Required term | What the contract has to say |
|---|---|
| Full service level descriptions | Precise quantitative and qualitative performance targets, with updates when they change. |
| Locations of processing and storage | The countries where functions are provided and data is processed and stored, plus notice before either changes. |
| Data availability, integrity and confidentiality | Provisions guaranteeing access to and recovery of data in a readily accessible format if the provider fails or the contract ends. |
| Access, inspection and audit rights | Unrestricted rights for the entity, its auditors, and its competent authority — real rights, not a summary report. |
| Assistance during ICT incidents | Support at no additional cost, or at a cost fixed in advance, when an incident touches the service. |
| Participation in resilience testing | Cooperation with the entity's threat-led penetration testing where the service supports a critical function. |
| Exit strategies and transition periods | A mandatory adequate transition period during which the service continues while the entity moves off it. |
The location clause is the one that decides most sovereignty questions on its own. It obliges the contract to name the countries where the function is provided and the data processed and stored, and to give notice before that changes — which is a harder commitment than a marketing claim about European data residency, and a more useful one.
§ 04 Standing · Where we are
Measured against the same articles. A supplier that will not publish this list is asking you to fill in the gaps optimistically.
| Question | Answer | Detail |
|---|---|---|
| Designated critical ICT third-party provider | No | Designation under Article 31 is made by the European Supervisory Authorities. We hold no designation, and no supplier can claim one for itself. |
| Financial entity contract in force | None | We are not on any financial entity's Article 28(3) register, in any Member State. |
| Locations of processing (Art. 30(3)(b)) | Not yet signable for live service | The Cyprus campus at Vasilikos is pre-construction. We cannot commit today to countries of processing for a service that is not yet running. |
| Audit and inspection rights (Art. 30(3)(e)) | Acceptable in principle | We have no reason to resist unrestricted audit and supervisory access, but principle is not an executed contract and should not be read as one. |
| ISO 27001, SOC 2, or equivalent | Not held | These are design targets, not certificates in hand. Any page of ours that reads otherwise is wrong and we want to know about it. |
| Sovereign Reserve Agreement | Commercial reservation only | An SRA reserves planned capacity. It is not a legal certification and does not by itself satisfy DORA, NIS2, the EU AI Act, or GDPR. |
Copperway, our EU-sovereign model gateway, is the surface that exists now. It is the honest starting point for a financial entity that wants to evaluate us: run something real through it, read the terms, and judge the contract we would actually be able to sign.
GatewayWe do not sell a fraud detection product, a credit scoring model, or a compliance monitoring agent. We are building sovereign compute. If a page of ours ever implies a finished financial AI product line, treat that page as the error.
Not offeredVasilikos is pre-construction. Until it operates, the location, resilience, and exit terms in Article 30(3) cannot be signed for a live service, and a reservation is not a substitute for signing them.
Pre-construction§ 05 Questions · FAQ
The ones a second-line risk function asks before a first meeting.
§ 06 Start · Contact
The useful first conversation is about which Article 30 terms we could sign, not about a capability demonstration. Bring your register entry and your exit strategy.