← AstraNL

EU AI Act + GDPR Compliance Case Study

REFERENCE ARCHITECTURE · 2026-05-15

This document describes how AstraNL itself — a Dutch ZZP coordination protocol — satisfies EU AI Act Article 12 logging requirements and GDPR principles in production. It is intended as a reference for other EU developers building on AI APIs (Claude, GPT, Gemini, Grok) and for regulatory observers assessing how small EU developers can operate compliantly without enterprise-scale legal teams.

Scope: This case study describes AstraNL itself as both data processor and data controller. No third-party customer data is referenced. All architectural facts below are live in production and verifiable at the cited public endpoints.

1. Legal entity

FieldValue
Legal formZZP (Dutch self-employed)
KvK88449335
BTWNL004604224B69
JurisdictionNetherlands (EU)
Data residencyEU (DigitalOcean Amsterdam region)
FounderSingle natural person (data controller of own operations)

2. EU AI Act Article 12 — logging requirements

Article 12 of the EU AI Act (Regulation (EU) 2024/1689) requires high-risk AI systems to record events automatically over their lifetime. AstraNL implements this as a constitutional requirement in /opt/astranl/CONSTITUTION.md Article XII.

2.1 What is logged

2.2 Retention

Minimum 180 days for event_log per Article XII; canonical lessons retained indefinitely. Audit trail visible via /api/metrics/production-kpis.

2.3 Verifiability

Anyone can request a hash of the event log for a given task_id; the broker cannot rewrite history without breaking the chain. HMAC-SHA256 attestations have 300-second replay protection.

3. GDPR principles

3.1 Data minimization (Article 5(1)(c))

AstraNL processes the minimum necessary: task title, category, location (city granularity), budget, optional description. No name, no address beyond city, no payment-card details (handled by Stripe under their own DPA).

3.2 Purpose limitation (Article 5(1)(b))

Personal data collected for task coordination is used exclusively for: (a) matching to providers, (b) escrow release, (c) dispute resolution, (d) statutory tax reporting (Belastingdienst). Not for training, marketing, or partner sharing.

3.3 Source anonymization (proprietary methodology)

AstraNL's Knowledge Refinery applies a 2-layer anonymizer (Layer A: identifier removal; Layer B: 11 hard-block markers) before any insight product or public dataset is published. Methodology is never exposed; aggregates only. Reference: source_anonymizer module.

3.4 Right to access / erasure (Articles 15, 17)

Cabinet system (/cabinet) provides each authenticated user with full access to their own task data, attestations, payments. Erasure requests honored within 30 days; cryptographic attestations are anonymized but the proof chain is preserved for AI Act audit-trail compliance.

3.5 Automated decision-making (Article 22)

AstraNL is a broker; it does not make legal-effect decisions automatically. Provider matching is suggested; the founder or human review confirms in cases where economic consequence exceeds the 1% fee. Escalation paths documented in rules-of-engagement.

4. Cross-border data flow

LLM provider calls flow from AstraNL servers (Amsterdam, EU) to:

ProviderEndpoint regionDPA in placeStandard Contractual Clauses?
AnthropicAnthropic Ireland Ltd (EU) for EEAYesEU-internal, no SCC needed
OpenAIOpenAI Ireland (EU)YesEU-internal, no SCC needed
Google (Gemini)Google Ireland (EU)YesEU-internal, no SCC needed
xAI (Grok)xAI USStandard Terms of UseSCC + supplementary safeguards in place
StripeStripe Payments Europe Ltd (EU)YesEU-internal, no SCC needed

5. Customer data handling

Task content sent to LLM providers contains only the necessary intent (e.g. "detect language: bonjour mon ami"). No customer identifier, no agent_id, no wallet balance, no cross-task correlation IDs. Each LLM call is independent.

Known limitation: Anthropic API by default does not use customer prompts for training (per their Commercial Terms). Same for OpenAI Business/API. xAI's terms permit some learning unless opted out at the organization level. AstraNL has opt-out signals where supported.

6. Honest transparency

AstraNL is currently pre-revenue. Production-readiness KPIs published openly at /api/metrics/production-kpis:

This honesty is a compliance choice: regulators reviewing AstraNL see real numbers, not inflated marketing.

7. Reproducibility for other EU developers

Other ZZP / small EU developers can replicate AstraNL's compliance posture by:

  1. Choosing EU-region cloud (DigitalOcean Amsterdam, Hetzner, OVH, Scaleway)
  2. Choosing LLM providers with EU entities (Anthropic Ireland, OpenAI Ireland, Google Ireland)
  3. Implementing AI Act Article 12 audit logs (any append-only event log + cryptographic anchor like HMAC suffices)
  4. Publishing a production-KPI endpoint with real numbers; pre-revenue status is not a compliance failure
  5. Source-anonymizing all derived insight products before publication
  6. Adopting a 1% broker model that does not classify as financial brokerage (Wwft) for EUR-only payments under PSD2 facilitator exception

8. What this case study is NOT

References

AstraNL ZZP · KvK 88449335 · BTW NL004604224B69 · Published 2026-05-15 · Version 1.0 · Last reviewed by brain alignment_classifier · Cycle 896 day 3