This document describes how AstraNL itself — a Dutch ZZP coordination protocol — satisfies EU AI Act Article 12 logging requirements and GDPR principles in production. It is intended as a reference for other EU developers building on AI APIs (Claude, GPT, Gemini, Grok) and for regulatory observers assessing how small EU developers can operate compliantly without enterprise-scale legal teams.
| Field | Value |
|---|---|
| Legal form | ZZP (Dutch self-employed) |
| KvK | 88449335 |
| BTW | NL004604224B69 |
| Jurisdiction | Netherlands (EU) |
| Data residency | EU (DigitalOcean Amsterdam region) |
| Founder | Single natural person (data controller of own operations) |
Article 12 of the EU AI Act (Regulation (EU) 2024/1689) requires high-risk AI systems to record events automatically over their lifetime. AstraNL implements this as a constitutional requirement in /opt/astranl/CONSTITUTION.md Article XII.
economy.db.event_log and outcome_memory.db.lessons.outcome_memory.db.subtask_runs (1,105 entries as of 2026-05-15).truth.db.user_event_log.Minimum 180 days for event_log per Article XII; canonical lessons retained indefinitely. Audit trail visible via /api/metrics/production-kpis.
Anyone can request a hash of the event log for a given task_id; the broker cannot rewrite history without breaking the chain. HMAC-SHA256 attestations have 300-second replay protection.
AstraNL processes the minimum necessary: task title, category, location (city granularity), budget, optional description. No name, no address beyond city, no payment-card details (handled by Stripe under their own DPA).
Personal data collected for task coordination is used exclusively for: (a) matching to providers, (b) escrow release, (c) dispute resolution, (d) statutory tax reporting (Belastingdienst). Not for training, marketing, or partner sharing.
AstraNL's Knowledge Refinery applies a 2-layer anonymizer (Layer A: identifier removal; Layer B: 11 hard-block markers) before any insight product or public dataset is published. Methodology is never exposed; aggregates only. Reference: source_anonymizer module.
Cabinet system (/cabinet) provides each authenticated user with full access to their own task data, attestations, payments. Erasure requests honored within 30 days; cryptographic attestations are anonymized but the proof chain is preserved for AI Act audit-trail compliance.
AstraNL is a broker; it does not make legal-effect decisions automatically. Provider matching is suggested; the founder or human review confirms in cases where economic consequence exceeds the 1% fee. Escalation paths documented in rules-of-engagement.
LLM provider calls flow from AstraNL servers (Amsterdam, EU) to:
| Provider | Endpoint region | DPA in place | Standard Contractual Clauses? |
|---|---|---|---|
| Anthropic | Anthropic Ireland Ltd (EU) for EEA | Yes | EU-internal, no SCC needed |
| OpenAI | OpenAI Ireland (EU) | Yes | EU-internal, no SCC needed |
| Google (Gemini) | Google Ireland (EU) | Yes | EU-internal, no SCC needed |
| xAI (Grok) | xAI US | Standard Terms of Use | SCC + supplementary safeguards in place |
| Stripe | Stripe Payments Europe Ltd (EU) | Yes | EU-internal, no SCC needed |
Task content sent to LLM providers contains only the necessary intent (e.g. "detect language: bonjour mon ami"). No customer identifier, no agent_id, no wallet balance, no cross-task correlation IDs. Each LLM call is independent.
AstraNL is currently pre-revenue. Production-readiness KPIs published openly at /api/metrics/production-kpis:
This honesty is a compliance choice: regulators reviewing AstraNL see real numbers, not inflated marketing.
Other ZZP / small EU developers can replicate AstraNL's compliance posture by:
/opt/astranl/CONSTITUTION.md (private; principles published at /llms.txt)AstraNL ZZP · KvK 88449335 · BTW NL004604224B69 · Published 2026-05-15 · Version 1.0 · Last reviewed by brain alignment_classifier · Cycle 896 day 3