The questionnaire, already answered.

Temja runs in the EU. Authentication, learner records, drill logs, and the audit chain are hosted on Google Cloud in europe-west, encrypted in transit with TLS and at rest. Data does not leave the EU in the ordinary course of running the service.

Credentials and API keys live in a managed secret store — never in the source repository and never in the browser bundle. The client ships only the public configuration a web app is expected to carry.

Tenant isolation is enforced at the data layer. Every document carries an organization scope; every read and write is checked against it, and the default is deny. A signed-in session never holds a key capable of writing outside that person's own organization, and it is scoped to a single organization and role — a learner credential cannot reach admin surfaces, by rule.

The audit log is append-only — no update path, no delete path. Each material event is hash-chained: hash = sha256(prevHash + entry), from a fixed genesis to the current head. Any tampering breaks the chain; the evidence pack verifies it end to end.

Sign-in is email and password, with every session organization- and role-scoped. Administrators can require MFA on their organization. Sensitive actions run through a signed command layer with bot protection (Google reCAPTCHA Enterprise) in front of them, so an automated client cannot drive them.

Single sign-on and SCIM provisioning are available on Enterprise, so joiners and leavers flow from your identity provider rather than a spreadsheet.

Training records, drill history, and the audit trail are retained for five years after an employee leaves by default — configurable per contract where a sector asks for longer or shorter.

A GDPR erasure request scrubs identifying details from the profile. The audit chain itself is never edited or deleted: existing entries keep standing and resolve to a de-identified actor reference. An evidence carve-out, not a loophole.

Temja is an educational tool, not a high-risk AI system. Drills are scripted simulations running on deterministic logic — not an autonomous system deciding employment, credit, or access. Adopting Temja does not add a new system to your AI inventory; it closes the training-duty gap Article 4 already opened.

We run Temja against our own staff and export our own Article 4 evidence pack. If we would not stake our own audit on it, we would not ask you to.

Drill reporting has an aggregate-only mode: catch rates and completion by team, never a named leaderboard of who was fooled. It is designed for Swedish and German works-council expectations, so training does not become surveillance. Individual records still exist for the learner and for audit; the management view can be locked to aggregates by policy.

Report it to security@temja.eu. We operate a 90-day coordinated disclosure window and will keep you credited and informed throughout.