Juralex Audit — EU AI Act Compliance Scanner

The all-in-one compliance platform for law firms. Monitor website compliance with EU AI Act, GDPR, and security standards.

Cookie Consent

We use cookies to enhance your browsing experience, serve personalized content, and analyze our traffic. Essential cookies are always active as they are necessary for the website to function correctly.

Cookie categories: Essential (required), Functional (language preferences), Analytics (Google Analytics), Marketing (not currently used).

You may Accept All cookies or Decline Optional cookies. You can change your preferences at any time.

By using our website, you consent to our Cookie Policy.

AI Transparency Disclosure

Juralex Audit uses artificial intelligence systems to assist with compliance analysis:

AI Provider: Juralex Audit sp. z o.o. (deployer and integrator)
Model Provider — OpenAI: GPT-4/GPT-4o for compliance analysis summaries and recommendations
Model Provider — Anthropic: Claude for legal documentation processing
Model Provider — Google: Cloud AI for document processing and classification
Custom ML Models: For pattern recognition in compliance data

Risk Classification: Juralex Audit is classified as a limited risk AI system under the EU AI Act risk-based framework.

Technical Documentation: We maintain technical documentation covering system architecture, data flows, performance metrics, and human oversight procedures, available to regulators upon request.

AI Incident Reporting: Users can submit an incident report for any AI malfunction, bias, or safety concern at ai-feedback@juralex.eu.

AI Literacy: In compliance with Article 4 of the EU AI Act, all staff receive regular AI training on capabilities, limitations, and ethical considerations.

Human Oversight: All AI-generated content is reviewed by qualified legal and compliance professionals before being presented to users.

See our full AI Transparency Policy.

Privacy Policy Summary

Lawful Basis for Processing (GDPR Article 6)

Article 6(1)(a) - Consent for marketing and non-essential cookies
Article 6(1)(b) - Contract performance for service delivery
Article 6(1)(c) - Legal obligations (tax, accounting)
Article 6(1)(f) - Legitimate interests (security, fraud prevention)

Data Subject Rights

Right to access (Article 15)
Right to rectification (Article 16)
Right to erasure / Right to be forgotten (Article 17)
Right to restrict processing (Article 18)
Right to data portability (Article 20)
Right to object (Article 21)
Rights related to automated decision-making (Art. 22) — no automated decisions with legal effects without human review
Right to withdraw consent

Data Breach Notification

In accordance with Articles 33 and 34 GDPR, we notify the supervisory authority (UODO) of any personal data breach within 72 hours. Affected individuals are notified without undue delay if the breach is likely to result in high risk to their rights.

Data Protection Impact Assessment (DPIA)

We conduct Data Protection Impact Assessments before introducing new AI-powered processing features, in accordance with Article 35 GDPR.

Privacy by Design and by Default

In accordance with Article 25 GDPR, Juralex Audit implements privacy by design principles: data minimization, encryption in transit and at rest, role-based access controls, and privacy-protective default settings.

Data Retention Periods

Account data: Duration of account + 3 years
Audit reports: 5 years
Financial records: 5 years
Marketing consents: Until withdrawal or 3 years inactivity
Log data: 90 days

International Data Transfers

Data is primarily processed within the EEA. Transfers outside the EEA are protected by EU Standard Contractual Clauses (SCCs) approved by European Commission (Decision 2021/914) or the EU-US Data Privacy Framework.

Data Processors

OVHcloud - Cloud hosting (EU-based)
Amazon Web Services (AWS) - Backup storage (eu-west-1, SCCs in place)
SendGrid (Twilio) - Email delivery (SCCs in place)
Google Analytics - Website analytics (DPA in place)
Stripe - Payment processing (PCI-DSS, SCCs in place)

All processors have Data Processing Agreements under Article 28 GDPR.