Compliance and Security
Built for regulated financial institutions
Bank-grade controls, an ISO 27001-certified security program, and privacy by design so that you can deploy Oper with confidence in regulated environments.
How Oper protects your data
Protecting customer data is a core responsibility. We combine strong security engineering with disciplined governance: encryption in transit (TLS 1.2+) and at rest (AES-256), secure infrastructure, customer data segregation, strict access management with multi-factor authentication, and continuous monitoring.
- Encryption in transit (TLS 1.2+)
- Encryption at rest (AES-256)
- Secure infrastructure
- Customer data segregation
- Strict access management
- Continuous monitoring
Where your data lives
One storage boundary: the Briefcase, inside your tenancy.
Your documents, extracted data and Herman’s outputs live in a single isolated store. No separate AI database, no hidden caches, no telemetry copies.
Never used for training.
No training datasets are derived from your customer data.
You control retention.
Retention periods are customer-defined. A temporary processing mode deletes all documents and outputs after each run, and deleting a Briefcase permanently removes everything in it.
European data residency.
Document processing and storage run in European cloud regions: Frankfurt and Switzerland by default.
Isolated per client.
Each client runs in their own logical tenancy with role-based access control. Production access is limited and every access is logged.
Deployment options.
A managed European cloud service, or scoped for deployment in your own environment.
Glass box, not black box
You define the rules and own the audit trail. The questions your risk team will ask, answered:
In one storage boundary: the Briefcase, inside your tenancy. Documents, extracted data, and outputs live in a single isolated store, never used for training. You define retention; a temporary mode deletes everything after each run.
Herman is designed for the EU AI Act's assistive framework, with human-in-the-loop oversight by design. Your team makes every decision.
Every recommendation is explainable, linked to its evidence and policy reference. Every step is logged.
No. Herman does not do credit scoring. He applies your written credit policy the same way to every file, not an opaque score on borrower characteristics.
ISO 27001-certified, DORA-ready, GDPR by design: a certified security program with the contractual framework regulated lenders need: audit rights, an exit plan, and incident reporting.
In European cloud regions, Frankfurt and Switzerland by default, or scoped for deployment in your own environment.
Regulatory alignment for due diligence
We are committed to GDPR principles and privacy by design, and we routinely support bank procurement, security reviews, and outsourcing assessments across the EEA. We support regulatory and risk teams with the evidence they need for due diligence, including:
Outsourcing & third-party risk
(EBA outsourcing expectations)
Data protection & privacy
(GDPR)
ICT risk & operational resilience
(DORA, NIS2)
Mortgage and consumer credit regulation
(Mortgage Credit Directive)
Digital identity and e-signatures
(eIDAS, where customers use e-signatures)
AI governance
(EU AI Act)
Plus national supervisory expectations, for example, BaFin circulars in Germany or BWG in Austria. DORA-ready. Delivered with the contractual framework supervised lenders need: audit rights, exit plan, incident reporting. We maintain incident response and business continuity practices, and we train our teams regularly to keep security part of everyday operations.
Specific regulatory requirements vary by institution and use case.