Sparcle for EU Finance

DORA-aligned. EU-region keys. DPO-verifiable inside the bloc.

EU financial institutions operate inside the bloc and inside DORA. Bolt and Aeira ship as customer-deployed software in EU regions, with customer-held KMS inside the EEA, an audit chain your DPO verifies offline, and a sub-processor topology where customer data does not transit Sparcle infrastructure.

Schedule EU finance review Download 1-page brief

Compliance frameworks

What Sparcle ships against.

EU financial-services compliance is the intersection of DORA, GDPR, NIS2, and the EU AI Act. Each frame below maps to a concrete implementation.

DORA (Digital Operational Resilience Act)

EU regulation applying to financial entities and their ICT third-party providers, effective January 2025. Bolt and Aeira ship as customer-deployed software inside the financial entity's perimeter, positioned as customer-deployed software in the DORA ICT-third-party register.

GDPR Art. 17 / 28 / 35

Right to be Forgotten via cryptographic erasure; Art. 28 data-processor responsibilities; Art. 35 DPIA for high-risk processing. Sparcle's sub-processor disclosure is asymmetric. Customer data does not reach Sparcle infrastructure in the shipping topologies.

NIS2 (Network and Information Security Directive 2)

Stricter cybersecurity baseline across EU essential and important entities. The five-phase incident-response framework, the audit chain integrity primitive, and the customer-held KMS posture map to NIS2 risk-management requirements.

EU AI Act (high-risk AI in finance)

Sparcle is the runtime, not the model. The Authority Policy SDK lets the financial entity encode the EU AI Act risk-management and human-oversight provisions; the audit-trail responses are the artifact the supervisor reviews.

Data residency posture

Inside the bloc. Inside your perimeter.

EU-region key residency

Customer-held KMS in an EU region (Vault Transit, AWS KMS Frankfurt/Ireland, Azure Key Vault EU). The crypto-shred construction means Sparcle cannot read tenant data without the customer-held CMK.

No transfer outside the EEA

Bolt and Aeira run inside the customer's EU perimeter. Customer data does not transit Sparcle infrastructure; sub-processor disclosure makes the transfer mechanism (or lack thereof) explicit.

DORA-aligned ICT third-party register

Sparcle is the customer-deployed software vendor under DORA; the customer's ICT-third-party register reflects that role. Sub-processor disclosure, MSA, and DPA template support the customer's register update.

DPO-verifiable artifacts inside the bloc

The standalone audit-chain verifier runs offline inside the EU perimeter. Your DPO does not need to transfer audit material outside the bloc to verify integrity.

1-page brief

Take this to your DPO and your CCO.

The EU finance brief covers DORA posture, GDPR + NIS2 alignment, EU-region key residency, and the trust artifacts a DPO and CCO review.

Download PDF Open in new tab ↗

Workflows the founding team has built for

Four anchor use cases.

The workflows below are scoped with EU-finance design partners. The Authority Policy SDK and connector configuration are the per-customer tuning points.

DORA self-attestation prep

Cross-source synthesis across vendor risk register, control attestations, and incident-response runbook. Authority Policy ranks current attestation versions above superseded ones.

GDPR DSAR response with crypto-shred

Subject erasure requests trigger the cryptographic-disposal construction; the disposal receipt is the artifact the supervisory authority receives. Erasure-with-retention via one primitive.

AML / KYC research with citation hygiene

Multi-source synthesis with provenance. The Authority Policy demotes outdated screening sources; every cited authority resolves to a current source-of-record.

NIS2 incident-notification drafting

Structured incident records pulled from the audit chain feed the 24-hour, 72-hour, and 1-month NIS2 notifications. The audit chain is the source-of-record the regulator reviews.

Trust dossier for EU finance

The four artifacts your DPO and supervisor will ask for.

  • /trust/cryptographic-erasure: The construction designed to satisfy GDPR Art. 17 obligations while preserving regulatory retention duties. The packet your DPO and supervisory authority receive.
  • /trust/subprocessors: Asymmetric topology + cross-border transfer mechanisms (SCCs, UK IDTA addendum). Why customer data does not reach Sparcle infrastructure in EU deployments.
  • /trust/verify: The standalone audit-chain verifier. Your DPO runs it offline inside the EU perimeter; the artifact a supervisory-authority audit relies on.
  • /trust/incident-response: Five-phase response framework aligned with the NIS2 notification timeline. The runbook a CISO at an EU financial institution expects.

Want to walk this against your specific DORA register and DPIA?

A 30-minute EU finance architecture review covers your DORA ICT-third-party posture, your KMS custody inside the EEA, your DPIA needs, and the workflows your team needs. Founder-led; the engineering team is on the call.

Schedule EU finance review All industries