Skip to content
EnaChat

Compliance

GDPR

  • Roles: the council is the data controller; Enantena is the data processor with a standard DPA.
  • Data processed: conversation text and aggregated usage statistics. No citizen registration or identification.
  • Retention: conversations purged after 90 days (configurable); IPs never stored raw.
  • Sub-processors: EU hosting and an AI model provider with an EU endpoint; full list in the DPA. Observability traces contain metadata only — never citizen text.
  • Rights: access/erasure requests are routed to the town’s DPO.

EU AI Act

Visible “automated assistant (AI)” disclosure from the first message and an “AI” indicator on every answer. No high-risk categories: it doesn’t decide about people, doesn’t profile, doesn’t transact.

Spanish National Security Scheme (ENS)

Designed for ENS basic-level conformity: EU hosting, staff 2FA, audit logging, daily backups and incident management. Conformity declaration and file-ready report delivered at onboarding.

Data journey

Widget → HTTPS → EnaChat service (EU) → search over the town’s database (EU) → answer drafting on an EU model endpoint → answer with citations back to the citizen. No citizen data ever leaves the European Union.

Accessibility

Widget conforms to WCAG 2.1 AA / EN 301 549, with the citizen office’s phone/in-person channel always visible.