Compliance

Last Updated: March 4, 2026

Autocrew is committed to meeting and exceeding regulatory requirements across the jurisdictions we operate in. This page outlines our compliance posture and the frameworks we adhere to.

Compliance Overview

As an AI-powered platform that processes business data on behalf of our customers, we take our regulatory obligations seriously. Our compliance program includes:

Continuous monitoring: Automated compliance monitoring tools that track our adherence to regulatory requirements in real time
Regular reviews: Periodic internal reviews of our security and privacy practices
Policy governance: A dedicated compliance team that maintains and updates policies as regulations evolve
Transparency: Clear documentation of our practices so customers can assess our suitability for their compliance needs

Autocrew complies with the General Data Protection Regulation (GDPR) for all processing of personal data of individuals in the European Economic Area (EEA) and United Kingdom.

We process personal data under the following legal bases:

Contract performance: Processing necessary to deliver the Autocrew platform and services you have subscribed to
Legitimate interest: Processing for service improvement, security monitoring, and fraud prevention, balanced against data subject rights
Consent: Marketing communications and optional analytics, where consent can be withdrawn at any time
Legal obligation: Processing required to comply with applicable laws, such as tax reporting and regulatory requests

Autocrew supports the exercise of all GDPR data subject rights. We provide mechanisms for individuals to:

Access their personal data and obtain a copy
Rectify inaccurate or incomplete personal data
Request erasure of personal data ("right to be forgotten")
Restrict processing in certain circumstances
Receive personal data in a portable, machine-readable format
Object to processing based on legitimate interest or direct marketing
Not be subject to solely automated decisions with legal or significant effects

Data subject requests can be submitted to support@autocrew-ai.com and are processed within 30 days.

Privacy impact assessments conducted for new features and processing activities
Data minimization principles applied across all data collection points
Pseudonymization capabilities for sensitive data processing
Default privacy settings that prioritize data protection

When personal data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional technical and organizational measures where appropriate. We monitor adequacy decisions and update our transfer mechanisms accordingly.

CCPA/CPRA Compliance

Autocrew complies with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) for California residents.

Categories of Personal Information

We may collect the following categories of personal information:

Identifiers (name, email address, account credentials)
Commercial information (subscription plans, billing history)
Internet activity (usage logs, feature interactions, IP addresses)
Professional information (company name, job title)
Inferences drawn from the above to improve our services

Consumer Rights

California residents have the right to:

Know what personal information is collected, used, and disclosed
Delete personal information held by us and our service providers
Correct inaccurate personal information
Opt out of the sale or sharing of personal information
Limit the use of sensitive personal information
Non-discrimination for exercising their privacy rights

"Do Not Sell or Share" Commitment

Autocrew does not sell personal information to third parties. We do not share personal information for cross-context behavioral advertising. Our data processing is limited to providing and improving our services.

Service Provider Obligations

When acting as a service provider on behalf of our customers, we process personal information only as directed by the customer and in accordance with our contractual obligations. We do not retain, use, or disclose personal information for purposes other than performing the services specified in the agreement.

SOC 2

We haven't started a formal SOC 2 certification process yet, but it is on our roadmap. Autocrew does not hold a SOC 2 report today. In the meantime, the platform includes these safeguards:

Encryption: Sensitive data, including patient health information, encrypted at rest with AES-256-GCM
Tenant isolation: Each customer's data is kept separate from every other customer's
Access logging: An audit trail on every patient-record access
Retention: Patient data purged on a retention schedule

HIPAA

Autocrew is built to be HIPAA-aware. We haven't started a formal HIPAA compliance process yet, but it is on our roadmap. For healthcare deployments, the platform:

Encrypts protected health information (PHI) at rest
Logs every access to patient records
Purges patient data on a retention schedule
Keeps PHI out of application logs
Does not send healthcare calls for AI summaries

Autocrew does not offer Business Associate Agreements (BAAs) today. BAAs will come with formal HIPAA compliance, which is on our roadmap.

ISO 27001

Autocrew is not ISO/IEC 27001 certified and has not started a certification process. ISO 27001 is on our roadmap alongside HIPAA and SOC 2.

AI-Specific Regulations

EU AI Act Awareness

Autocrew monitors developments under the EU AI Act and proactively assesses our AI systems against its risk classification framework:

Classification of AI crew capabilities by risk level
Transparency obligations — clear disclosure when users interact with AI systems
Human oversight mechanisms for AI-driven decisions
Technical documentation of AI system capabilities and limitations
Ongoing monitoring for bias, accuracy, and robustness in AI outputs

Responsible AI Practices

Bias monitoring: Regular evaluation of AI models for unintended bias across demographic groups and use cases
Fairness assessments: Testing to ensure AI outputs do not disproportionately impact any group
Explainability: AI decisions can be explained and reviewed, with audit trails of AI processing activities
Model governance: Formal review and approval processes for AI model deployment and updates

Data Protection Impact Assessments

Autocrew conducts Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in a high risk to individuals:

DPIAs conducted before deploying new AI features or processing activities
Assessments cover data flows, risk identification, and mitigation measures
Regular reviews of existing DPIAs as processing activities evolve
Summary findings available to enterprise customers upon request

Subprocessor Management

We maintain rigorous oversight of all subprocessors that process data on our behalf:

Due diligence: Security and privacy assessments conducted before engaging any new subprocessor
Contractual requirements: Data Processing Agreements (DPAs) executed with all subprocessors, requiring equivalent data protection standards
Change notification: Customers notified at least 30 days before any material change to subprocessors that handle their data
Ongoing monitoring: Regular reassessment of subprocessor compliance and security posture

Certifications and Roadmap

Autocrew does not currently hold any compliance certifications. Formal HIPAA compliance, SOC 2 certification, and ISO 27001 certification are on our roadmap. Current security activities include:

Penetration testing: Annual third-party penetration testing by independent security firms
Vulnerability assessments: Continuous automated vulnerability scanning across our infrastructure

Customers can request security documentation by contacting our team. For more information about our technical security controls, see our Security page.

Contact Us

If you have questions about our compliance practices or need to request compliance documentation, please contact us:

Compliance Team: support@autocrew-ai.com
Data Protection Officer: support@autocrew-ai.com