Trust Center
This page states where Luscent runs, what it holds, who can reach it, and what is not yet true. Luscent is a seed-stage company and does not hold a security certification. Everything below is written so that a reviewer can check it rather than take it on trust.
At a glanceSection 01
- Client data residencyEuropean Union only
- Client data storeScaleway, Paris region, France. Single region
- AI inferenceEU-hosted, EU providers only
- Non-EU model APIs in the client-data pathNone
- Client notification after a confirmed breachWithin 24 hours
- ISO/IEC 27001Controls aligned, certification not held
The ten facts most reviewers open this page for
Every figure on this page traces to Luscent's infrastructure security map. Per-system detail is in the security pack.
- 01
It stays in the EU.
Client data is stored and processed in the European Union.
Section 02 → - 02
Your CRM stays the record.
Luscent reads your CRM and does not write to it. In Microsoft 365 it acts only when the Relationship Manager does.
Integrations → - 03
A person decides.
The firm and its professionals, at all times. Luscent decides nothing for the firm.
Section 06 → - 04
Not used to train models.
Client data is not used to train or fine-tune models.
Section 04 → - 05
Yours to delete on exit.
Deleted or returned on termination, as the data processing agreement sets out.
Section 08 →
- Client data residency
- European Union only
- Client data store
- Scaleway, Paris region, France. Single region
- Data and AI services
- Hetzner, Germany
- AI inference
- EU-hosted, EU providers only
- Non-EU model APIs in the client-data path
- None
- Sub-processors with access to client data
- Three
- Encryption at rest
- AES-256 on the client data store
- Encryption in transit
- TLS 1.3 on public connections
- Client notification after a confirmed breach
- Within 24 hours
- ISO/IEC 27001
- Controls aligned, certification not held
All client data stays in the European Union
Luscent stores and processes all client data in the European Union. Its client data store runs in a single region, Scaleway's Paris region in France. Its data and AI services and its model trace store run on Hetzner in Germany. Luscent's own identity and internal communications run inside the Microsoft EU Data Boundary and hold no client data.
Architecture and data-residency overview available on request.
Two Luscent sub-processors are not established in the European Union. Tailscale, a United States company, provides the encrypted network between Luscent’s own machines. Traffic is end-to-end encrypted with keys Tailscale does not hold, so Tailscale receives connection metadata only, even when its relays carry traffic that cannot connect directly. Mailgun sends Luscent's outbound email, and the sending domain is provisioned in Mailgun's United States region rather than its European one. Luscent states this here rather than leaving it to be discovered in a questionnaire.
Luscent's zones inside the European Union: Microsoft EU Data Boundary for identity and internal communications; Scaleway's Paris region for the application, database, storage and fallback AI inference; and Hetzner in Germany for the data and AI services, observability and the model trace store. Tailscale, a United States company, sits outside the boundary and receives network metadata only.
Encrypted where it is stored,and on every public connection
Client data reaches Luscent over TLS 1.3. Inside Scaleway, Luscent services talk over WireGuard on a private mesh, and client data is written to a managed database and to object storage encrypted with AES-256 at rest. Backups are encrypted to the same standard as their source.
Customer-managed keys are not available today.
The data and AI services and the model trace store run on Hetzner in Germany, behind default-deny firewalls that admit only Luscent's own production address. Encryption per system, host by host, is in the security control register in the security pack.
- Client systemsMicrosoft 365, Salesforce
- TLS 1.3
- Ingest and APIScaleway, Paris region
- Firewalled
- Data and AI servicesHetzner, Germany
- Firewalled
- Database and storageScaleway, Paris regionAES-256 at rest
- LUSCENT INFRASTRUCTURE · EUROPEAN UNION
Client data travels from client systems over TLS 1.3 to Luscent's ingest and API in France, then to the data and AI services on Hetzner in Germany, then to the database and object storage in France, encrypted with AES-256 at rest. The two hops to and from Hetzner are firewall-restricted. Every stage after ingest runs on Luscent infrastructure inside the European Union.
| Scope | Standard | Implementation |
|---|---|---|
| In transit, public | TLS 1.3 | Managed certificates with automatic renewal, HSTS enforced |
| In transit, internal | WireGuard | ChaCha20-Poly1305 across the Tailscale mesh, between Luscent's Scaleway services |
| At rest, database | AES-256 | Scaleway managed encryption, keys held in Scaleway KMS |
| At rest, object storage | AES-256 | Server-side encryption, private bucket policy, versioning enabled |
| Backups | AES-256 | Encrypted to the same standard as the source |
Encryption keys for data at rest are held in Scaleway's key management service. Customer-managed keys are not available today and are on the roadmap.
Where the record itself lives
A firm that already runs a CRM keeps it, and Luscent reads from it. A firm without one will be able to use the Luscent CRM, which Luscent builds in-house, which is in build today and which is included for Luscent clients at no extra cost. It is deliberately lightweight, it is designed to run inside the same EU deployment, behind the same API boundary as the rest of the platform, and it is not a third-party product. Choosing it will add no sub-processor to the list in section 05.
Inference is EU-hosted,from EU providers only
Inference is hosted in the European Union by EU providers only. No OpenAI, Anthropic, Google or other non-EU model API sits in the path of client data.
Documented EU AI Act Article 50 position available on request.
Training
Luscent does not use client data to train or fine-tune models. Luscent consumes models as served infrastructure.
Human review
Luscent staff do not read client data as a matter of course. Access to production data is limited to investigating a fault or responding to a client request, is performed by named individuals under the access controls described in section 07, and is logged.
Deterministic where it matters
Luscent's compliance checks run on a deterministic rules engine, not on a language model. A rule produces the same result on the same input every time, which is the property an auditor needs and the property a probabilistic model does not have. Language models are used to read and summarise communications; they do not decide whether an obligation is met.
EU AI Act
Luscent is a provider of an AI system under Regulation (EU) 2024/1689. The Article 50 transparency obligations applied on 2 August 2026. The high-risk regime was rescheduled by Regulation (EU) 2026/1744 to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Luscent's documented Article 50 position is available to clients and prospects on request. Luscent does not describe itself as compliant with an obligation before that is true.
Six sub-processors.Two outside the European Union.
Luscent publishes its complete sub-processor list here and updates it when it changes. Jurisdiction is the second column because it is the second question.
This list is published here and updated whenever it changes.
| Sub-processor | Jurisdiction | Purpose | Data | Agreement |
|---|---|---|---|---|
| Scaleway (Iliad Group) | France (Paris region) | Compute, managed database, object storage, model inference | Client relationship data and Signal outputs | Article 28 terms in Scaleway's data processing agreement |
| Mistral AI | France (EU API endpoint) | Language model inference | Client-derived text sent for inference | Article 28 terms in Mistral AI's data processing agreement |
| Hetzner Online GmbH | Germany | Hosting for Luscent's data and AI services and for observability, including the language-model trace store. Planned: encrypted backup copies | Requests handled by the data and AI services, and client-derived text in model traces. Backup copies will be encrypted with keys held outside Hetzner. | Hetzner data processing agreement (Article 28), concluded before client data reaches Hetzner |
| Microsoft | Microsoft EU Data Boundary | Identity, internal collaboration and communications | No client data. Internal documents and business communications. | Microsoft Products and Services Data Protection Addendum |
| Tailscale | United States | Encrypted mesh network between Luscent services | Network metadata only. Traffic is end-to-end encrypted over WireGuard with keys Tailscale does not hold, including when a Tailscale relay carries it. | Tailscale data processing agreement |
| Mailgun (Sinch) | United States | Outbound email sent from mailer.luscent.io | Recipient address and message content for email Luscent sends from that domain. | Mailgun data processing agreement |
Where Luscent's people are
Luscent's leadership is in Luxembourg and Germany, and its engineering team works from Brazil. Development and staging environments hold no client data.
What bounds that access is written down and testable. Engineering access to production runs through Microsoft Entra ID with multi-factor authentication enforced, and through tag-based access control on the Tailscale mesh. No engineer holds direct access to the production database. Production changes reach production only through the deployment pipeline. Development and staging environments contain no client data. Access is revoked from a single checklist on departure.
Luscent does not hold a security certification
Luscent has mapped its controls to ISO/IEC 27001:2022 and that work is continuous. Luscent does not hold the certificate and does not describe itself as certified. Certification requires an accredited external audit, targeted for 2027. A SOC 2 Type I report is planned for 2027 and a Type II report for 2028.
Luscent holds no security certification today. The schedule says when, not whether.
Luscent has aligned its controls to ISO/IEC 27001:2022 and this work is continuous. Luscent does not hold the ISO/IEC 27001 certificate; certification is planned for 2027. A SOC 2 Type I report is planned for 2027 and a SOC 2 Type II report for 2028.
| Standard | Status | Target |
|---|---|---|
| ISO/IEC 27001 | Controls aligned, certification not held | Certification targeted for 2027 |
| SOC 2 Type I | Not held | Planned 2027 |
| SOC 2 Type II | Not held | Planned 2028 |
What Luscent is, and is not
| Question | Answer |
|---|---|
| What Luscent is | A technology provider: software that wealth managers use on their own Client communications |
| What Luscent is not | A regulated financial institution. It holds no CSSF authorisation and gives no investment, legal or compliance advice |
| Who decides | The client firm and its professionals, at all times. Luscent produces evidence and Signals; it decides nothing for the firm |
| Under DORA | An ICT third-party service provider to the financial entities it serves |
| Under the GDPR | Processor for client data, on the firm's documented instructions; controller for its own business data |
| Where it is based | Luxembourg, in formation, and a member of the Luxembourg House of Financial Technology (LHoFT) |
Regulation that applies to Luscent as a company
These are obligations on Luscent as your supplier. DORA appears in this table and in no other, because DORA describes how Luscent operates as an ICT third-party service provider. It is not a feature of the Luscent product and Luscent does not present it as one.
| Regulation | Instrument | Status | What it means here |
|---|---|---|---|
| GDPR | Regulation (EU) 2016/679 | Applies | Luscent is a processor of client data and a controller of its own business data. |
| DORA | Regulation (EU) 2022/2554 | Applies as ICT third-party provider | Luscent supports its clients' Article 28 register and due-diligence obligations. Evidence available on request. |
| EU AI Act | Regulation (EU) 2024/1689 | Applies as provider | Article 50 transparency obligations applied on 2 August 2026. Luscent's Article 50 position is documented and available on request. |
| NIS2 | Directive (EU) 2022/2555 | Monitored | Applicability follows client sector and Luxembourg transposition. |
Regulation the product helps you evidence
These are obligations on you. Luscent produces the record that evidences them. The distinction between this table and the one above is deliberate: a supplier that blurs the two is describing its own compliance as though it were yours.
| Regulation | What Luscent produces |
|---|---|
| MiFID II | Suitability evidence and audit trail |
| GDPR | Lawful basis records, retention, subject-request support |
| EU AI Act | Transparency and human oversight |
| FinSA and FinIA | Nothing yet. Swiss coverage is on the roadmap |
| WpHG, WpDVerOV and MaComp | Nothing yet. German conduct rules are on the roadmap |
| FinVermV (§34f GewO) | Nothing yet. German broker rules are on the roadmap |
| UK Consumer Duty | Nothing yet. UK coverage is on the roadmap |
| Retail Investment Strategy (EU) | Nothing yet. Expected 2029 |
| CVM and ANBIMA | Resolutions 30, 178, 35, 19 and 50 |
| LGPD | Brazilian data-protection acknowledgment |
What is in place today,and where the full register is
The controls below are deployed and operational. The full register, with the status of every control, including those still being formalised or planned, is in the security pack.
Identity and access
| Control | Status | Implementation |
|---|---|---|
| Multi-factor authentication | In place | Enforced for every Luscent staff account through Microsoft Entra ID. |
| Least privilege | In place | Administrative infrastructure access is held by two people. Engineers cannot reach the production database directly. |
| Network access control | In place | Tag-based access lists across the Tailscale mesh. |
| Offboarding | In place | Identity deactivation, mesh removal and repository revocation run from a single checklist on departure. |
Engineering and change
| Control | Status | Implementation |
|---|---|---|
| Environment separation | In place | Development, staging and production are separate instances on separate network tags. Development and staging hold no client data. |
Monitoring and operations
| Control | Status | Implementation |
|---|---|---|
| Application and infrastructure monitoring | In place | Metrics and logs with alerting on critical errors and resource thresholds. |
| Network access logging | In place | Every mesh connection event is recorded. |
| Time synchronisation | In place | All instances synchronised, all log timestamps in UTC. |
Policy and organisation
| Control | Status | Implementation |
|---|---|---|
| Named security roles | In place | A security lead, an infrastructure owner, an application security owner and an executive accountable for every external security claim. |
| Segregation of duties | In place | Two-person integrity for production change. |
| Confidentiality undertakings | In place | Signed by every member of staff and every contractor. |
Luscent is your processor,not your controller
For client data, you are the controller and Luscent is the processor under Article 28 of Regulation (EU) 2016/679. Luscent processes client data only on your documented instructions. For Luscent's own business data, such as the details of the people it contracts with, Luscent is the controller.
The data processing agreement is available before any commercial commitment.
Luscent signs a data processing agreement with every client. The template is available before any commercial commitment, so that your legal review can start at the same time as your technical one rather than after it. Write to legal@luscent.io for the template.
Data subject requests
Where a data subject exercises a right against you as controller and the data sits in Luscent, Luscent assists with access, rectification, erasure and portability within the timeframes set by the data processing agreement. Requests go to privacy@luscent.io.
Brazil
Luscent acknowledges the Lei Geral de Protecao de Dados for Brazilian client data and maintains the corresponding records. Brazilian engineering personnel access is described in section 05.
Retention
Client data is retained for the term of the agreement and deleted or returned on termination as set out in the data processing agreement. Operational retention periods are below.
| Record | Retention |
|---|---|
| Database backups and point-in-time recovery | 30 days |
| Application and infrastructure logs | 30 days |
| Network access logs | 90 days |
| Identity and sign-in audit logs | 30 days |
Recovery objectives
Luscent runs a high-availability managed database in France with automatic failover, and backups run automatically with 30 days of point-in-time recovery. Luscent's client data store runs in a single region and Luscent does not claim cross-region replication or failover. Recovery objectives for the loss of the Paris region are not yet stated.
These are design objectives for the architecture as deployed, not measured results.
| Scenario | Recovery point objective | Recovery time objective |
|---|---|---|
| Single instance failure | No data loss | Under 5 minutes |
| Database failure | Under 1 minute | Under 15 minutes |
| Loss of the Paris region | Not yet stated | Not yet stated |
| Data corruption | Under 24 hours | Under 2 hours |
| Complete infrastructure loss | Not yet stated | Not yet stated |
Clients hear within 24 hours
Luscent commits to notifying affected clients within 24 hours of confirming a security incident that affects their data. Article 33 of the GDPR allows 72 hours for notification to a supervisory authority. Luscent sets its own commitment 48 hours inside that ceiling, because a client who learns late cannot act at all.
Report a vulnerability to security@luscent.io.
- 0Detectioncontinuous monitoring
- 1hClassificationseverity P1 to P4
- 2hContainmentP1. P2 within 8h
- 24hClient notifiedLuscent commitment48 hours of margin
- 72hGDPR Article 33regulatory ceiling
- 5bdRoot causetechnical review
- 10bdReportwritten and shared
Luscent classifies a security incident within one hour of detection, contains a P1 incident within two hours, and notifies affected clients within 24 hours. That is 48 hours inside the 72-hour ceiling set by Article 33 of the GDPR. Root cause analysis follows within five business days and a written report within ten business days.
| Phase | Commitment | Detail |
|---|---|---|
| Detection | Continuous | Automated monitoring and alerting |
| Classification | Within 1 hour | Severity assigned, P1 to P4 |
| Containment | Within 2 hours for P1 | Within 8 hours for P2 |
| Client notification | Within 24 hours | More restrictive than the 72 hours allowed by GDPR Article 33 |
| Root cause analysis | Within 5 business days | Technical review |
| Post-incident report | Within 10 business days | Written and shared |
Reporting a vulnerability
Security researchers should write to security@luscent.io. Luscent asks for a reasonable period to remediate before public disclosure, and does not pursue legal action against good-faith research conducted on those terms.
Available now
Luscent does not gate the two documents a reviewer needs first. The sub-processor list is on this page and the data processing agreement is available before any commercial commitment. The rest arrive by return of email rather than through a portal, because at Luscent's size a portal would be theatre.
No portal. A person replies by email.
| Document | Access | Notes |
|---|---|---|
| Data processing agreement | On request | Article 28 template, available before commercial commitment |
| Sub-processor list | Public | Published on this page and updated when it changes |
| Architecture and data-residency overview | On request | Zone architecture with regions and data classes |
| DORA Article 28 information pack | On request | For a client's register of information and due diligence file |
| EU AI Act Article 50 position | On request | Documented provider assessment |
| Security control register | On request | Every control with its status, including those being formalised or planned, and encryption per system |
| Security questionnaire response | On request | Completed against the reviewer's own format |
The questions a review actually asks
Grouped in the order a review runs. Every answer is written to stand on its own, so it can be pasted straight into a questionnaire, and every question has its own link, so an answer can be sent on without sending the whole page.
Hover a question to copy a link to that answer on its own.
What Luscent holds
Where does Luscent store client data?#
Luscent stores and processes all client data in the European Union. The client data store is in Scaleway's Paris region in France, a single region; Luscent's data and AI services and its model trace store run on Hetzner in Germany. No client data is stored or processed outside the European Union.
Does client data ever leave the European Union?#
No. Luscent stores client data, processes it and runs model inference on it entirely within the European Union, and no non-EU model API sits in the path of client data. Two Luscent sub-processors are established outside the European Union. Tailscale, a United States company, provides the encrypted network between Luscent's own machines and receives connection metadata only, because that traffic runs peer to peer rather than through Tailscale servers. Mailgun sends Luscent's outbound email, and the sending domain is provisioned in Mailgun's United States region rather than its European one.
What client data does Luscent hold?#
Luscent holds client relationship records, communication metadata, the Signals and Health Scores the platform derives from them, and financial summaries such as assets under management. Luscent treats all of this as its most restricted class. Its primary store is in Scaleway's Paris region in France; Luscent's data and AI services and its model trace store run on Hetzner in Germany.
The Luscent CRM and integrations
What is the Luscent CRM, and is it a third-party product?#
The Luscent CRM is built in-house by Luscent. It is not a third-party product, and Luscent does not bundle or resell another vendor's CRM. It is in build and not yet part of the shipped product. It is included for Luscent clients at no extra cost. It is deliberately lightweight: it is designed to hold client records, activity history and relationship data for firms that do not already run a CRM, on the same EU infrastructure as the rest of the platform, behind the same API boundary, and it introduces no additional sub-processor.
Does Luscent require a firm to replace its existing CRM?#
No. Luscent is an intelligence layer over the systems a firm already runs. A firm with an existing CRM such as Salesforce keeps it, and Luscent integrates with it. A firm without one will be able to use the Luscent CRM, which is in build and included for Luscent clients at no extra cost. The system of record stays wherever the firm wants it.
Which systems does Luscent connect to?#
Luscent integrates with Microsoft 365 and with Salesforce, and is building its own in-house CRM for firms that do not run one. Each connection is authorised by the firm through the provider's own consent flow and is scoped to what the firm chooses to share.
AI
Which AI models does Luscent use, and where do they run?#
Inference is hosted in the EU by EU providers only. No OpenAI, Anthropic, Google or other non-EU model API sits in the path of client data.
Does Luscent train models on client data?#
No. Luscent does not use client data to train or fine-tune models. Luscent consumes models as served infrastructure.
Does a language model decide whether a firm is compliant?#
No. Luscent's compliance checks run on a deterministic rules engine, not on a language model. A rule produces the same result on the same input every time, which is the property an auditor needs and the property a probabilistic model does not have. Language models are used to read and summarise communications; they do not decide whether an obligation is met.
How is Luscent classified under the EU AI Act?#
Luscent is a provider of an AI system under Regulation (EU) 2024/1689. The Article 50 transparency obligations applied on 2 August 2026. The high-risk regime was rescheduled by Regulation (EU) 2026/1744 to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Luscent's documented Article 50 position is available to clients and prospects on request.
Who can reach it
Who at Luscent can access client data?#
Access to production systems is limited to named individuals under enforced multi-factor authentication and tag-based network access control. Administrative infrastructure access is held by two people. No engineer holds direct access to the production database. Luscent staff do not read client data as a matter of course: access happens to investigate a fault or to answer a client request, and it is logged.
Where are Luscent's engineers located?#
Luscent's leadership is in Luxembourg and Germany, and its engineering team works from Brazil. Engineering access to production is governed by enforced multi-factor authentication and tag-based network access control, and no engineer holds direct production database access. Development and staging environments contain no client data.
Does Luscent support single sign-on?#
Yes. Luscent authenticates users through Microsoft Entra ID single sign-on, and session policy is configurable per client firm.
Which sub-processors have access to client data?#
Three. Scaleway processes client data as Luscent's infrastructure provider in France; Hetzner hosts Luscent's data and AI services and its model trace store in Germany; and Mistral AI (France) is the primary language model inference provider for client-derived text, through its EU regional endpoint, with Scaleway's EU inference service as the fallback. Microsoft holds Luscent's own code, documents and internal communications and does not receive client data. Tailscale carries network metadata only, because traffic between Luscent services is end-to-end encrypted with keys Tailscale does not hold, including when its relays carry it.
Does Luscent use any United States sub-processor?#
Yes, two. Tailscale is a United States company and provides Luscent's encrypted internal network. Tailscale receives connection metadata only. Client data does not reach Tailscale servers, because traffic runs peer to peer over WireGuard directly between Luscent's own instances. Mailgun sends Luscent's outbound email, and the sending domain is provisioned in Mailgun's United States region rather than its European one.
Certifications and regulation
Is Luscent ISO 27001 certified?#
No. Luscent has mapped its controls to ISO/IEC 27001:2022 but does not hold the certification. Formal certification is targeted for 2027. Luscent will not describe itself as certified before an accredited auditor has issued the certificate.
Is Luscent SOC 2 compliant?#
No. Luscent does not hold a SOC 2 report. A SOC 2 Type I report is planned for 2027 and a Type II report for 2028.
Does Luscent hold a DORA registration?#
DORA does not create a registration for ICT providers of Luscent's size. Luscent operates as an ICT third-party service provider to financial entities and supports its clients' obligations under Article 28 of Regulation (EU) 2022/2554, including the information required for their register of information. DORA is a statement about how Luscent operates, not a feature of the Luscent product.
Is Luscent a controller or a processor of client data?#
For client data, the client firm is the controller and Luscent is the processor under Article 28 of Regulation (EU) 2016/679. Luscent processes client data only on the firm's documented instructions. For Luscent's own business data, such as the details of the people it contracts with, Luscent is the controller.
Contracts, exit and incidents
Can Luscent sign a data processing agreement?#
Yes. Luscent signs a data processing agreement under Article 28 of the GDPR with every client. The template is available on request before any commercial commitment.
What happens to client data when an agreement ends?#
Client data is retained for the term of the agreement and is deleted or returned on termination, as set out in the data processing agreement. Backups age out of the 30-day point-in-time recovery window that applies to the production database.
How quickly does Luscent notify clients of a security incident?#
Within 24 hours of confirming a security incident affecting client data. This is more restrictive than the 72 hours that Article 33 of the GDPR allows for notification to a supervisory authority.
What is Luscent's legal entity?#
Luscent S.à r.l., a société à responsabilité limitée in formation in Luxembourg, with its registered office at House of Startups, 9 Rue du Laboratoire, L-1911 Luxembourg. The company is in formation and its registration number will be published here once the filing with the Registre de Commerce et des Sociétés is complete.
Who does a security researcher contact?#
security@luscent.io. Luscent asks researchers to allow a reasonable period for remediation before public disclosure and does not pursue legal action against good-faith research conducted under those terms.
A person answers each of these
Each address reaches a monitored mailbox, not a form.
- Security and vulnerability reports
- security@luscent.io
- Privacy and data subject requests
- privacy@luscent.io
- Contracts and data processing agreements
- legal@luscent.io
- Legal entity
- Luscent S.à r.l. (in formation)
- Registered office
- House of Startups, 9 Rue du Laboratoire, L-1911 Luxembourg
Luscent S.à r.l. is in formation. Its registration number will be published on this page once the filing with the Registre de Commerce et des Sociétés is complete. This page was last reviewed on and is updated when the underlying architecture, sub-processor list or certification status changes.
No portal.A person replies by email.
Find out before you move a single client record.
Ninety days, at no cost, with three to five relationship managers, starting on invented clients. Success metrics are agreed in writing before anything is connected, so at the end there is a decision rather than an impression.
The terms
- Length
- 90 days
- Cost
- Nothing
- Seats
- 3 to 5 relationship managers
- Data
- Synthetic first
- Client data
- Stays in the EU
- Writes back
- Nothing
- DAY 0Metrics agreed, in writing
- ConnectWeek 1 to 4
- WEEK 4The book, ranked
- First Signal acted onWeek 5 to 8
- WEEK 8A decision on the record
- ReviewWeek 9 to 13
- DAY 90Written review