SovOrg Policy Statement

Who we are and what this covers

SovOrg is Sovaign, a Dutch software company run by its owner. We build and host Sovaign, a compliance engine that helps organisations build and keep a management system they can get certified. It reads their documents, proposes what each one proves, and shows what is missing. A named person at the customer decides on every proposal. Alongside the solution, we advise organisations on compliance.

Our customers rest their audit position on what we build. That shapes everything below. We must be dependable (quality), we hold other organisations' documents (information security), and AI is part of the product and of how we build it (AI).

Scope (clause 4.3 of all three standards). Our management system covers:

Quality, information security and AI management of the development, hosting and support of the Sovaign solution and associated compliance consultancy.

It is one management system with three parts:

• Quality: developing, hosting and supporting the Sovaign solution, and the compliance consultancy we deliver with it.
• Information security: the information we hold, ours and our customers', in the solution and in consultancy work, and the systems, suppliers and people that handle it.
• AI: the AI systems we provide in the solution, the AI services we use (our model supplier), and the AI we use to develop the solution and in consultancy work.

The scope's boundaries, locations and interfaces with suppliers, and any requirement of a standard that does not apply, with the reason why, are recorded in the scope document.

Our commitments

Top management commits SovOrg to six things.

1. We meet our requirements. We meet what customers agree with us, the law and regulation that apply to us (including the GDPR and the EU AI Act), our contracts with suppliers, and the requirements of the three standards we work to. We find out which ones apply and keep that list current.
2. We deliver what customers can rely on. Customers get a product that does what we say it does, works when they need it, and is supported when it doesn't. We measure their satisfaction and act on complaints.
3. We protect the information in our care. We keep our own and our customers' information confidential, correct and available. We decide on protection by assessing risk, and we accept a remaining risk only as a named, recorded decision.
4. We use AI responsibly. AI proposes and a named person decides. We use AI only within the purpose we state for it. We assess the risks and the impact on the people and organisations it affects, and we keep every AI output traceable. Where we cannot evaluate something, we say so rather than guess.
5. We keep improving. We learn from incidents, complaints, audits, measurements and mistakes. We fix the cause, not just the symptom, and we improve the management system itself, not only the product.
6. We give it what it needs. Top management provides the time, money, people and tools the management system needs, and takes part in its review.

How we set objectives

This policy does not set the objectives. It sets the frame they must fit. Top management sets objectives for quality, information security and AI at least once a year and at every management review, and records them in the objectives register.

Every objective:

• serves one of the commitments above, or treats a risk or opportunity we have identified;
• is measurable, or can be checked as clearly met or not met;
• has an owner, a target date and a stated way to measure it;
• is measured on its schedule, and the result is recorded with its date;
• is reviewed at the management review, and changed or closed when it no longer fits.

The three parts each have at least one current objective. For example: customer issues answered within a set time (quality), restore tested within a set period (information security), or AI changes measured before release (AI). The targets themselves live in the register, not here.

How we work

In practice, the commitments mean the following.

• A person decides. Approvals, sign-offs and changes to access are made by a named person and recorded with who, when and what. A machine, including an AI agent, may propose, but it never decides.
• Unknown stays unknown. Missing evidence is shown as missing, and anything we cannot evaluate is shown as "cannot evaluate". Nothing gets reported as fine just because nobody checked it.
• Changes go through one gate. Every change to the product is tested and reviewed before release. The same applies to AI prompts, models and thresholds, which are also measured before release. A change that fails the gate does not ship.
• Least access, strong sign-in. People and agents get only the access their role needs. Deciding and administering need the person present with their own key. Access is removed when it is no longer needed.
• Customers own their data. Customer data stays in the EU unless the customer chooses otherwise. It is encrypted at rest, and the customer can take all of it with them and have it erased.
• Suppliers are chosen and checked. Hosting, model and other suppliers are selected on their security, privacy and AI terms, and checked again when those terms change.
• Incidents are reported and learned from. Anyone who sees a security or AI incident, or a quality failure, reports it straight away. We contain it, inform those affected and the regulators where the law requires, and record what we changed as a result.
• We spend within limits. Paid AI use has an enforced ceiling and can be stopped at once.

Communication, availability and review

Inside SovOrg. Everyone who works for us, staff and contractors that work on our behalf, gets this policy when they start. People confirm that they have read it. The policy is available to agents. Top management checks at the management review that the policy is understood and applied.

Outside SovOrg. This policy is published on sovaign.com. More detailed policies are not published; we give them to customers, suppliers, auditors and regulators when they need them to work with us.

Review. Top management reviews this policy at least every three years. It also reviews sooner after any of these:

• a significant change to the business, the product or how AI is used in it;
• a change in the law or the standards;
• a serious incident;
• a finding from an audit or management review that touches the policy.

Every review ends in a new version with its date and the approver's name, even when the text stays the same. The previous versions are kept. The newest dated version is the evidence that the review happened.

Document control