The questionnaire, already answered.

Temja runs on Google Cloud, and the EU is where we deploy it. Authentication, learner records, drill logs, and the audit chain are configured for europe-west, encrypted in transit with TLS and at rest. Before your first real learner record exists we confirm the live region and the subprocessor list with you in writing — we would rather show you the deployment than assert it. The public demo holds fictional data only.

Credentials and API keys live in a managed secret store, never in the source repository and never in the browser bundle. The client ships only the public configuration a web app is expected to carry.

Tenant isolation is enforced at the data layer. Every document carries an organization scope; every read and write is checked against it, and the default is deny. A signed-in session never holds a key capable of writing outside that person's own organization, and it is scoped to a single organization and role. A learner credential cannot reach admin surfaces, by rule.

The audit log is append-only, with no update path and no delete path. Each material event is hash-chained: hash = sha256(prevHash + entry), from a fixed genesis to the current head. Any tampering breaks the chain; the evidence pack verifies it end to end.

Sign-in is verified email and password, with every session organization- and role-scoped. Sensitive actions run through a trusted command layer with rate limits and production App Check enforcement.

Tenant-admin MFA, single sign-on, and SCIM do not exist today — everyone signs in with a verified email and password. An Enterprise engagement can add an identity-provider integration: we agree the provider and the joiner-mover-leaver tests up front, and it counts as delivered when those tests pass, not when the contract is signed.

We propose a five-year default and write the period you actually need into your contract. Deleting on that schedule is a manual operation today: the retention jobs and their restore tests are unfinished, so do not read this as automatic expiry.

An erasure request removes or de-identifies profile data while leaving the append-only audit chain intact — that chain is what makes the evidence worth anything. We work each request by hand today; the automated, tested de-identification path is not built.

Temja is an educational tool, not a high-risk AI system. Drills are scripted simulations running on deterministic logic, not an autonomous system deciding employment, credit, or access. Adopting Temja does not add a new system to your AI inventory; it closes the training-duty gap Article 4 already opened.

Temja produces evidence of training measures; it is not an accredited certification and does not replace counsel's assessment of your organisation's obligations.

Report it to security@temja.eu. We operate a 90-day coordinated disclosure window and will keep you credited and informed throughout.

Machine-readable at /.well-known/security.txt.