Trust Center - Chino.io

Compliance

Overview

Chino.io combines expert legal-technical consulting with ChecksMATE, its compliance automation platform, to guide companies through Europe's data protection and security landscape.

We cover GDPR, HIPAA, ISO 27001, NIS2, the EU AI Act, and national laws across EU member states. We translate this complex, overlapping landscape into one coherent compliance strategy.

ChecksMATE then operationalizes that strategy, automating the implementation, monitoring, and evidence of compliance in place of manual checklists and one-off audits. This turns compliance from a cost center into a scalable system that keeps pace with new regulations.

The result: companies move faster with confidence, cutting time-to-market and overhead while giving clients, regulators, and investors clear proof of trust. This approach is already used by companies across EU, US, and worldwide, spanning digital health, AI, and other sensitive-data sectors.

Compliance Controls

Confidentiality or non-disclosure agreements

Legally binding confidentiality or non-disclosure agreements (NDAs) are systematically utilized to ensure personnel, vendors, and clients protect sensitive information from unauthorized disclosure.

Intellectual property rights

Measures and legal guidelines are implemented to identify, protect, and respect proprietary software, trade secrets, trademarks, and copyrighted material from unauthorized use or infringement.

Return of assets

Formal procedures are established to ensure all employees, contractors, and external parties return all corporate hardware, software, and data upon termination of employment or contract.

Security of assets off-premises

Security protocols and configurations are enforced to protect corporate hardware and information assets when used, transported, or stored outside the organization's primary physical boundaries.

Responsibilities after termination or change of employment

Security duties, non-disclosure obligations, and legal responsibilities that remain valid after an individual's role changes or employment ends are clearly defined and enforced.

Operation planning and control

Operational processes and IT activities are systematically planned, documented, and monitored to ensure the secure, consistent, and predictable delivery of corporate services.

Development life-cycle

A structured governance framework is maintained to manage the software development lifecycle securely, embedding security reviews from initial planning to final release.

Code Quality

Automated and manual code review practices are enforced to ensure that software is secure, reliable, and compliant with modern industry coding standards.

Application information security

Measures are implemented to ensure that all data handled by applications is processed, stored, and managed in strict compliance with organizational security requirements.

Application testing

Regular security assessments, including vulnerability scanning and penetration testing, are performed on applications to proactively identify and remediate flaws.

Application distribution

Secure deployment pipelines and distribution channels are established to guarantee the integrity and authenticity of software updates and product releases.

Application security controls

Technical mechanisms and built-in security features are integrated directly into software applications to defend against logical exploits and vulnerabilities.

Right to be informed

Clear and accessible mechanisms ensure individuals are provided with comprehensive information regarding how their personal data is collected, used, and shared.

Right of access

Procedures are established to allow individuals to verify, request, and receive a clear copy of the personal data processed or held by the organization.

Right to rectification

Processes enable individuals to request and execute the prompt correction or completion of inaccurate or incomplete personal information.

Right to erasure

Deletion protocols are maintained to fulfill individual requests for the permanent removal of personal data when operational or legal retention requirements are met.

Right to restrict processing

Capabilities are implemented to temporarily limit or suspend data processing operations when the accuracy or lawfulness of the processing is contested by the individual.

Right to data portability

Systems support the extraction of personal data in a structured, commonly used, and machine-readable format, enabling seamless transfer to other service providers.

Rights in relation to automated decision making

Safeguards are in place to protect individuals from adverse impacts of decisions made solely by automated systems, granting them the right to request human intervention and review.

Resources

Compliance Certificates

ISO 27001 Certificate

ISO 9001 Certificate

ISO 13485 Certificate

Gender Equality Certificate

GDPR Documentation

TOMs - Technical and Org. Measures

ChecksMATE - Data Processing Agreement

FAQs

All data is hosted and stored in the EU, specifically within Hetzner Online GmbH servers in Germany. Backups are stored on OVH in France.

Chino.io maintains a multi-layered backup strategy to ensure reliability and continuity of service. Databases run in a High Availability cluster with live replication across multiple servers, plus continuous streaming to a separate backup server enabling point-in-time recovery, with daily backups retained for 6 months. Daily encrypted (AES256) snapshots of VMs, databases, and other data are kept on-site for up to 6 months, and replicated to a separate facility in another country for disaster recovery, also retained for up to 6 months.

Yes, we perform periodic penetration tests. Reach out to us for more information.

No. Chino.io uses third-party AI models exclusively through API integrations governed by zero-data-retention (ZDR) agreements. Under these agreements, customer data submitted to the AI provider is processed only to generate the requested output and is not stored, logged, or used to train, fine-tune, or otherwise improve the provider's models. Data is discarded immediately after processing, and Chino does not use customer data to train any AI model.