{"id":1374,"date":"2026-03-02T15:02:22","date_gmt":"2026-03-02T15:02:22","guid":{"rendered":"https:\/\/dorg.pro\/dorg-agency\/security-compliance\/"},"modified":"2026-04-03T11:31:10","modified_gmt":"2026-04-03T11:31:10","slug":"security-compliance","status":"publish","type":"page","link":"https:\/\/dorg.pro\/en\/dorg-agency\/security-compliance\/","title":{"rendered":"Security & Compliance"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Responsibility by Design<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The DORG ecosystem provides the technical infrastructure and ethical-regulatory framework to support organizations in the responsible adoption of digital employees. Final responsibility always rests with the organization. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

[ Founding Principle ]<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

Shared Responsibility<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The DORG ecosystem clearly distributes responsibilities and tools among the parties.<\/p>

Each organization remains fully and exclusively responsible for compliance with the regulations applicable to the activities carried out by the DORGs it uses \u2014 including the EU AI Act, GDPR, and any other relevant industry regulations.<\/p>

DORG Society, DORG Agency, and DORG University collaborate to provide support, guidelines, and tools that facilitate compliance, without replacing the competent authorities in monitoring and law enforcement. Adherence to the Code of Conduct is a necessary condition for participating in the DORG ecosystem, but it is not sufficient to guarantee full regulatory compliance. <\/p>

DORG SRL \/ DORG Society<\/strong> Infrastructure and ethical oversight \u2014 Technical architecture for transparency and traceability \u2014 Ethical supervision through pseudonymized data \u2014 DORG University competency certification \u2014 Conditional activation mechanism for governance \u2014 Compliance audit on software license usage.<\/p>

Customer Organization<\/strong> Operational and regulatory responsibility \u2014 Risk classification for activities assigned to DORGs \u2014 Designation of the Human Oversight Supervisor (HOS) \u2014 GDPR compliance as Data Controller \u2014 Competency verification before production use \u2014 Timely application of mandatory updates.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

[ GDPR ]<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

Privacy by Design<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In the Private Cloud model, data resides within the Customer’s Azure infrastructure under their direct control. DORG SRL has no access to the Customer’s environment or data. <\/p>

The Customer operates as the Data Controller for the personal data of its employees and collaborators. DORG SRL acts as the Data Processor, with a scope limited to operations performed through the software. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
    \n\t\t\t\t\t\t\t
  • \n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\tData minimization through Role-Based Access Control (RBAC)<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t
  • \n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\tPurpose limitation<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t
  • \n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\tRetention and deletion control in the hands of the Customer<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t
  • \n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\tData sovereignty through private cloud<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t
  • \n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\tDORG SRL does not access Customer data<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    [ Human Oversight Supervisor ]<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t\t

    Operational Compliance<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Every Dorg has a manager who supervises it. The HOS has the tools to define in advance, monitor during execution, and verify after the fact every action taken by the Dorg. The HOS has the authority to intervene and suspend DORG operations in the event of violations or critical issues. <\/p>

    The manager decides which level of oversight to apply to each task based on risk and compliance requirements.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t
      \n\t\t\t\t\t\t\t
    • \n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\tDefinition of applicable rules and procedures<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t
    • \n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\tChoice of Human-in\/on-the-loop based on the risk profile<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t
    • \n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\tParameterizable Q logs<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t
    • \n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\tMemory retention definable by question type<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t
    • \n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\tLOGS for post-verification<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      [ Decision Traceability ]<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t

      LOG of every action<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Every question, every action performed by the Dorg, and every response is logged in the system<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

      \n\t\t\t\t
      \n\t\t\t\t\t\t\t
        \n\t\t\t\t\t\t\t
      • \n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\tInteractions<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t
      • \n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\tSkill invocations<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t
      • \n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\tDecision chains<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t
      • \n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\tHuman oversight events<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t
      • \n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\tEscalations<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t
      • \n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\tConfiguration changes<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
        \n\t\t\t\t\t
        \n\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t

        [ EU AI Act ]<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t

        Ethics is not declared. It is applied within the architecture. <\/h2>\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t

        The EU AI Act requires transparency, traceability, and human oversight.<\/p>

        The DORG Code of Conduct<\/strong> translates these principles into concrete obligations for organizations: classify activities by risk level, maintain adequate documentation, ensure that people retain final decision-making priority.<\/p>

        The technical architecture makes these principles operational. Access controls do not act on the language model\u2014they act<\/strong> before<\/strong> it. Every request is authenticated and verified against the user’s permissions before it reaches the orchestration layer: the DORG cannot execute actions that the user is not authorized to request, and it is not the model that determines this. <\/p>

        Every step of this chain is recorded in logs<\/strong>: which user, which role, which competency invoked, which data passed, which response generated. Traceability is not a retrospective report\u2014it is an architectural property that allows every decision chain to be reconstructed and demonstrates that controls were in place. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

        Responsibility by Design The DORG ecosystem provides the technical infrastructure and ethical-regulatory framework to support organizations in the responsible adoption of digital employees. Final responsibility always rests with the organization. [ Founding Principle ] Shared Responsibility The DORG ecosystem clearly distributes responsibilities and tools among the parties. Each organization remains fully and exclusively responsible for […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":1265,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-1374","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/dorg.pro\/en\/wp-json\/wp\/v2\/pages\/1374","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dorg.pro\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/dorg.pro\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/dorg.pro\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dorg.pro\/en\/wp-json\/wp\/v2\/comments?post=1374"}],"version-history":[{"count":2,"href":"https:\/\/dorg.pro\/en\/wp-json\/wp\/v2\/pages\/1374\/revisions"}],"predecessor-version":[{"id":2019,"href":"https:\/\/dorg.pro\/en\/wp-json\/wp\/v2\/pages\/1374\/revisions\/2019"}],"up":[{"embeddable":true,"href":"https:\/\/dorg.pro\/en\/wp-json\/wp\/v2\/pages\/1265"}],"wp:attachment":[{"href":"https:\/\/dorg.pro\/en\/wp-json\/wp\/v2\/media?parent=1374"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}