Your data is protected by design

What it requires

Personal data is processed lawfully, securely, and only for defined purposes. A company processing data on your behalf must sign a processing agreement (Art. 28), disclose its subprocessors, support your obligations toward data subjects, and notify you of breaches in time for your 72-hour report. Transfers outside the EU require approved safeguards.

How Platform24 complies

• Roles and contract. You are the controller, Platform24 (Twelvedevs) is the processor. Every engagement starts with a signed DPA that includes the full list of subprocessors, AI model providers included, and a description of our technical and organisational security measures (TOMs).
• Data location. Pilots run in the EU or the US, by your choice. In production, Platform24 is deployed in your environment and configured to your security requirements.
• AI model providers. We select the model per task (Google Gemini, Mistral, OpenAI, Anthropic), and each provider is named in the DPA with its processing region. Transfers to non-EU providers rely on Standard Contractual Clauses or the EU–US Data Privacy Framework. Local models are available for sensitive workloads.
• No training on your data. Your operational data is never used to train AI models.
• Your obligations, supported. We assist with data subject requests and your Data Protection Impact Assessment, and notify you of any breach without delay.

What it requires

Since August 2026, people must be informed when they interact with an AI system. Providers and deployers of AI systems carry distinct responsibilities. From December 2027, AI used for workforce management (task allocation, monitoring of work) faces additional requirements: risk management, logging, human oversight and technical documentation.

How Platform24 complies

• Clear roles. Platform24 (Twelvedevs) is the provider of the AI system, you are the deployer. We supply the documentation and instructions you need to meet deployer obligations.
• AI transparency. Every agent that messages or calls a driver, customer or partner identifies itself as AI.
• No emotion recognition. Platform24 analyses what is communicated (delays, issues, requests) and never infers the emotional or psychological state of drivers, dispatchers or other staff.
• Scoped autonomy. Agents act only within the policies, permissions and limits you define. Anything outside those limits is escalated to your supervisor with full context.
• Built for 2027 today. Decision logging, human oversight and documentation are part of the product now, ahead of the workforce-management requirements.

What it requires

Transport and logistics operators within NIS2 scope must manage cybersecurity risk across their supply chain, including software and service providers, and report significant incidents: an early warning within 24 hours and a full notification within 72 hours.

How Platform24 complies

• Minimal, scoped access. Platform24 works on top of your existing systems with only the permissions each agent needs.
• Full audit trail. Every agent action is logged and the logs are available to you.
• Incident notification aligned with your 24h / 72h reporting obligations.
• Supplier assessments. We answer your NIS2 supplier questionnaires and security reviews as part of onboarding.

What it requires

National laws transposing the Directive apply from December 2026 to operators organising work through digital platforms, such as last-mile delivery. Workers must be informed about automated monitoring and decision-making systems, significant decisions affecting them require human review, and data processing is restricted: no data collection outside working time and no processing of private communications.

How Platform24 complies

• Driver decisions stay human. Any sanction, suspension or evaluation of a driver is decided by a person. Agents prepare the case, your team decides.
• Explainable assignments. Every assignment is logged with its reason: why a load went to a specific driver and by which criteria.
• Data limited to work. Location and monitoring are active only during shifts and orders. Only work channels between dispatch and drivers are processed.
• Ready-made transparency. We provide a system description you can share with your drivers and their representatives.

What it requires

Since September 2025, providers of data processing services must allow customers to export their data and switch providers without obstruction.

How Platform24 complies

• Export anytime in structured, machine-readable formats.
• No lock-in. Switching to another provider is never blocked.

What it requires

From July 2027, authorities across the EU must accept electronic freight transport information provided through certified eFTI platforms. Legally binding electronic signatures and seals are governed by eIDAS.

How Platform24 complies

• Works with your eFTI and eCMR platforms. Platform24 reads, checks and prepares freight documents and exchanges data with your certified platforms.
• Signatures stay with authorised people. Agents never sign legally binding documents. Signing remains with your authorised staff through your trust service provider.