Lifetime Legal & Compliance Hub

Transparency as a Service.

At Lifetime Oy, we believe that legal clarity is the foundation of industrial trust. Our "Compliance First" architecture is designed to turn complex EU regulations—such as Fit for 55, the EU AI Act, the Digital Services Act (DSA), the EU Data Act, and GDPR—from liabilities into competitive assets for our clients.

Below you will find our complete legal framework, governing our software, services, and commercial relationships. Each policy carries an explicit effective date, last review, and named escalation channel to simplify vendor-risk assessments.

0. Compliance at a Glance

This overview summarises the key legal and compliance controls for Lifetime Group (Lifetime Oy, Finland & DWS IQ Oü, Estonia), the DWS IQ 6 Platform, the Firehorse product line, Lifetime Consulting & Advisory services, and Lifetime Studios services.

---

1. EU AI Act Self-Classification

Lifetime Oy maintains formal documentation of DWS IQ 6's classification under the EU AI Act (Regulation 2024/1689), enforceable from 2 August 2026.

Documented Compliance Elements

Regulatory Timeline

---

2. Digital Sovereignty (New)

🛡️ EU-Sovereign by Design

• For All Customers: Understand your deployment options — EU-sovereign infrastructure is the default; US hyperscalers are an available secondary option.
• Deployment Options (EU-first):
  • Sovereign Private Cloud ⭐ Recommended: On-premise or dedicated infrastructure with customer-managed encryption. Maximum EU sovereignty and data residency guarantee.
  • European Cloud ⭐: Hetzner (Helsinki), Scaleway (Paris/Amsterdam/Warsaw), OVHcloud (EU regions) — no CLOUD Act exposure, GAIA-X aligned, 100% EU jurisdictions
  • US Hyperscalers (secondary option): AWS, Google Cloud, Azure — EU region data residency available, but CLOUD Act jurisdiction may apply. Suitable where EU-sovereign clouds do not meet performance or tooling requirements.
• Product Defaults: Firehorse local installations preferred for maximum sovereignty. Edge AI on NVIDIA Jetson keeps sensitive data on-premise. Google Cloud Run europe-north1 (Finland) used for managed EU Cloud deployments.

---

2. Investor Security

⭐ Why Your Investment in Lifetime Oy is Secure

• For Investors: A direct guide for US and International investors on how EU compliance and Finnish stability protect your capital.
• Quick Summary:
  • World-Class Data Security: GDPR ensures your investor data and our IP are protected by strict legal frameworks.
  • Transparency by Design: Finnish corporate law and CSRD alignment give you clear visibility into governance.
  • Stable Foundation: Finland ranks #1 globally for rule of law and political stability.
  • Future-Proofed Standards: Compliance with EU sustainability regulations positions your investment for long-term growth.

---

3. Privacy & Data Governance

• Data Protection Management (Tietosuojajohtaminen):

  • We run data protection as a managed, risk-based discipline — not a one-off compliance badge. Leadership commitment, a planned governance model, and continuous improvement underpin both effective risk management and a rising level of data protection.
  • Aligned to ISO/IEC 42001 (AI Management System) and ISO/IEC 27001, with DPIA-driven prioritisation so effort follows the highest-impact risks. See the Compliance Hub for the managed-program view.

• ⭐ Privacy Policy & GDPR Statement

  • For Everyone: How we handle data, cookies, and your rights.
  • Key Assurance: We do not use your private industrial data to train our public models. We deploy Private Cloud instances to ensure full data sovereignty.
  • Data Subject Requests: Export, correction, and deletion requests are acknowledged within 2 business days and fulfilled within 30 days.

• ⭐ Data Security Policy

  • For Business Partners: How we protect confidential data with zero-knowledge encryption.
  • Key Features: Proton Mail E2EE, Proton Drive encryption, EU data residency options.
  • Compliance: GDPR, EU AI Act, NIS2, EU Data Act documented.

• ⭐ Data Handling Policy

  • For Team & Partners: Data classification (CONFIDENTIAL/INTERNAL/PUBLIC), AI tools usage policy, storage guidelines.
  • Key Rules: No cloud AI for confidential data, encrypted local database, Proton Drive backups.
• Data Processing Agreement & SCCs: Our modular DPA aligns with IT2022 EHK terms. View the full DPA or request a signed copy via [email protected].
• Data Protection Officer: Acting DPO – Risto Anton Päärni, CEO ([email protected]). The data protection management program is backed by external data-protection and AI-governance expertise (advisory bench) to ensure independent, risk-based oversight.
• AI Act Compliance: DWS IQ and Firehorse are classified as limited-risk systems with full technical documentation.

---

4. Digital Services & Platform Accountability

• Digital Services Act alignment: Lifetime Oy operates below the VLOP threshold but voluntarily complies with Articles 14–24.
• Transparency Digest: Quarterly metrics available upon request at [email protected].
• Notice & action channel: Report suspected illegal content or AI misuse via [email protected]. We reply within 48 hours.
• NIS2 & incident reporting: 24-hour early warning to Traficom, final report within 72 hours.

---

5. Commercial Agreements

• ⭐ Agreement & Project Terms

  • For Clients: The master service agreement framework. We generally follow IT2022 terms.
  • Scope: Confidentiality (NDA), IPR transfer, and general liability.

• ⭐ Professional Services Terms

  • For Consulting Clients: Specific terms for advisory, implementation, and "Kickoff" packages.
• Service Levels & Incident Credits: Baseline SLA provides 99.5% monthly uptime for DWS IQ. Enterprise tiers can extend to 99.9% uptime.
• Procurement shortcut: Downloadable compliance summary included in each proposal pack. Request via [email protected].

---

6. Product Terms of Service

• ⭐ DWS IQ Terms of Service

  • For SaaS Users: Governs the use of the DWS IQ platform.
  • Focus: SLA, uptime, and permissible use of AI agents.
  • Autonomous Guardrails: AI agents cannot trigger safety-critical actions without human validation.

• ⭐ Firehorse Terms of Service

  • For Automation Users: Terms for Firehorse reporting and marketing automation.
  • Marketing Compliance: Unsubscribe, consent, and auditable templates for EU and US outreach.

• ⭐ Lifetime Fleet Terms

  • For Logistics Partners: Terms for physical robotics, drone, and vehicle operations.
  • Regulatory Alignment: EU Machinery Regulation, EASA drone operator requirements.

---

7. Investor Relations

• ⭐ Regulatory Notice for Investors
  • For Investors: Details on our SAFE offering, compliance strategy, and risk factors.

---

8. Return & Performance Policy

• ⭐ Return Policy
  • Digital services: SaaS subscriptions may be cancelled within 14 days for a full refund.
  • Physical hardware: 14-day statutory withdrawal right plus 60-day performance guarantee.
  • Professional services: Kickoff deposits refundable until the first milestone workshop.

---

9. Security Research

Independent research and analysis on AI safety, cybersecurity, and enterprise risk management informing our platform security posture and compliance architecture.

• International AI Safety Report 2026 — DWS Field Note New

  • Source: International AI Safety Report 2026 (Yoshua Bengio et al., 100+ experts, 30+ countries)
  • Key Findings: Existing AI safety practices are insufficient. Three risk categories: misuse, malfunction, systemic risks. 60% of advanced economy jobs exposed to AI. Autonomous agent governance urgently needed.
  • DWS Impact: Validates Article 12 compliance architecture, Firehorse human-in-the-loop model, and climate-AI convergence positioning.
  • Full Report: internationalaisafetyreport.org

---

10. Security & Trust

Security is not a feature — it is the foundation of every DWS IQ deployment. Our security architecture is designed for EU-regulated industries where agent failures have legal, financial, and safety consequences.

Security Architecture

Three Evidence Layers for D&O Safe Harbor

D&O insurers require documented governance that proves “reasonable measures” were in place before an AI agent acted. The KYA Standard produces three independent layers of evidence, each mapped to a distinct liability question:

1. Identity Attribution. Proves which agent produced the output — not “our AI.” Every agent carries a cryptographic identity bound to its deployment context, which isolates director decisions from agent failures.
2. Fault Attribution. Separates LOGIC_FAULT (agent error) from OPERATOR_FAULT (human misconfiguration) from MANIFEST_FAULT (deployment issue). Demonstrates that the board’s governance framework was adequate even when an individual agent fails.
3. Behavioral Guardrails. Pre-execution controls were active before the agent acted, enforced by the Leash Snap Protocol in < 5 ms per decision. This is the “reasonable measures” standard recognised across EU member-state corporate governance codes for personal-liability safe harbour.

Continuous Security Testing

• 15 CI/CD security workflows — automated on every commit (SAST, dependency scanning, secret detection)
• Automated penetration testing — internal pentest suite covering OWASP Top 10 and OWASP LLM Top 10 (auth bypass, CORS, SSRF, prompt injection, MCP tool poisoning, supply chain)
• Weekly dependency audit — npm audit + Bandit/Safety for Python components
• Pre-commit hooks — block credentials, secrets, and PII from entering version control

AI-Specific Security (OWASP LLM Top 10)

• Prompt Injection Defense: All MCP tool responses treated as untrusted input; no auto-installation of community skills
• Sensitive Data Exposure: Agent sandbox isolation prevents cross-tenant data access; KYA session boundaries enforce data separation
• Supply Chain Risk: No auto-install from community registries; all dependencies pinned with lockfiles; SRI hashes on CDN resources
• Agent Autonomy Control: Five autonomy tiers (1–5) with human-in-the-loop required for safety-critical actions; no autonomous actuations without validation

Certifications & Compliance Roadmap

Responsible Disclosure

We welcome security researchers who identify vulnerabilities in our platform. Please report findings responsibly:

• Contact: [email protected]
• Acknowledgment: Within 48 hours of report
• Fix Timeline: Critical — 48 hours; High — 7 days; Medium — 30 days; Low — next release cycle
• Scope: dws10.com, dws6.com, onelifetime.world, API endpoints, MCP servers
• Out of Scope: Social engineering, physical attacks, denial of service

See our security.txt (RFC 9116) for machine-readable security contact information.

---

11. Customer Risk Disclosures

Lifetime Oy provides the following disclosures in the interest of full transparency. We encourage prospective customers, deployers, and investors to review these with their own legal and compliance teams before integration.

EU AI Act — Deployer Responsibility

Our limited-risk self-classification applies to DWS IQ 6 as designed and deployed by Lifetime Oy. Under Article 28 of the EU AI Act, deployers bear independent responsibility for their own use-case risk assessment. If you integrate DWS IQ 6 into operations that may constitute safety-critical infrastructure under Annex III — for example, energy grid control, transport critical infrastructure, or employment-decision systems — a higher-risk classification may apply to your specific deployment, regardless of our provider-level classification.

We have designed DWS IQ 6 with preparatory controls (human oversight, audit trails, risk management tiers) that ease any such reclassification. Contact [email protected] to discuss your specific integration scenario before go-live.

Product Maturity & Early Commercial Stage

DWS IQ 6 v1.0 launched on 23 February 2026 and is in an active pilot and early commercial phase. Real-world regulatory enforcement of AI Act claims across EU markets will mature after the August 2026 deadline. Enterprise customers should allow for a standard evaluation period. Our SLA (99.5% baseline uptime) and return policy protect your deployment commitment during this phase.

Third-Party Audit Status

As a limited-risk AI system, no notified-body review or CE marking is required or planned. ISO 27001 certification is targeted for Q4 2026. Internal automated penetration testing (OWASP Top 10 + LLM Top 10) was established Q1 2026 and runs continuously. Annual external third-party pentest is planned for H2 2026 (report will be available under NDA upon request). No independent AI conformity assessment has been conducted to date — this is consistent with the limited-risk regime.

Regulatory Interpretation Risk

EU AI Act interpretation — particularly for Annex III point 1 (critical infrastructure) and cross-sector industrial AI — is still evolving as the EU AI Office publishes implementation guidance. Lifetime Oy monitors EU AI Office communications and updates its compliance position accordingly. Our governance framework is designed to accommodate regulatory clarifications without architectural rework.

---

12. Contact & Escalation

---

13. Board Governance & D&O Safe Harbor

KYA (Know Your Agent) is the governance framework that makes autonomous AI agents court-defensible, insurable, and EU AI Act compliant. It is designed for boards and directors who approve agentic AI deployments in EU-regulated industries.

KYA Framework: Two Standards

• KYA-S (Security Standard). Agent identity, behavioural guardrails, pre-execution controls. Proves which agent did what and that controls were active before it acted. Enforcement latency < 5 ms per decision.
• KYA-O (Optimisation Standard). Agent Trust Score (ATS 0–100), autoresearch governance, reliability metrics across production deployments.

Full specification: KYA Standard v1.5.

D&O Insurance Impact

---

14. EU-Regulated Industries Coverage

DWS IQ 6 is designed for autonomous-agent governance across the industries most exposed to Fit for 55, CBAM, ETS, CSRD, and the EU AI Act. Coverage is organised in three regulatory-exposure tiers: