Trust
What is certified, what is mapped, and how to check it
This page sets out what Dynamics Consulting can show about itself and about Nexus MDS Core, and how a client or an auditor can check it, without having to take anyone’s word for it.
Certifications
None held
Neither Dynamics Consulting nor Nexus MDS Core holds a certification of any kind.
Conformity with a standard or a regulation is established by the assessment that standard or regulation provides for — a certification audit, a conformity assessment procedure, a supervisory authority — not by the supplier’s own statement. When a page on this site says a control is mapped on a requirement, that is exactly what it means: mapped, not certified.
Method
What is mapped, and how
Controls are mapped on the GDPR, the EU AI Act, ISO/IEC 27001:2022, the revised Product Liability Directive (PLD), NIS2 and other frameworks with the Compliance-Epistemic Project Framework (CEPF). The mapping states, for each requirement, which control answers it and which evidence shows that it is in place.
CEPF v7 — 19 frameworks, 247 requirements, 24 cross-framework overlap groups, 695 document templates — snapshot July 2026
The catalogue itself is not published.
Sub-processors
Who else touches the data
Two different things, kept apart: this website, and the Nexus MDS Core installations that run at clients.
This website
As listed in the privacy policy, all bound by data processing agreements:
| Processor | Purpose | Location |
|---|---|---|
| Resend | Email delivery: sending contact-form notification emails | USA |
| Vercel | Cloud hosting: website infrastructure and edge delivery | EU / USA |
| AI inference endpoint | Generating the answers of the site’s AI Assistant, only if you enable it | European Union |
Transfers to the United States rely on the EU–US Data Privacy Framework or on Standard Contractual Clauses, as described in the privacy policy.
Nexus MDS Core installations at clients
Nexus MDS Core runs on the client’s infrastructure. Indexing, retrieval, identity and audit stay inside the client’s perimeter, behind a single gateway. The components outside it are these:
Nebius AI — EU endpoint
Generation of the final answer
The default generation endpoint, in an EU datacentre, chosen to keep hardware costs down. It is replaceable: another provider can take its place, and on a GPU server the local model (llama.cpp) runs the same step, so the whole chain stays inside the perimeter.
HyperLog
External operational logging
Receives the gateway’s operational logs only, proxied through the gateway. No prompts and no model answers.
OpenAI, Anthropic, Gemini
Optional model providers
Off unless the client chooses to enable them. When enabled they are reached through the same gateway routes and recorded in the audit service like any other model call; direct calls from the applications are blocked at DNS level.
The full map, service by service, is on the platform page.
Audit
How the hash chain is verified
Every model call, local or external, passes through the gateway’s AI routes, which hand a record of it to the audit service. Each record is encrypted and chained to the one before it by its hash: altering, removing or reordering a record breaks the chain from that point on, and the break shows.
- On demand. The audit service has a verification endpoint: given a range of records, it recomputes the chain over them and returns whether it is intact or altered.
- Independently. A separate command-line tool, used for restores, verifies the chain from the stored records without relying on the running service to vouch for itself.
- Over time. Records are archived monthly. Each archive comes with a manifest that links it to the active chain, so the chain can be followed from the archive into the live records without a gap.
The verification endpoint lives inside each installation and is reachable only there; it is not a public service.
Security
Reporting a security issue
If you find a vulnerability in this website or in Nexus MDS Core, write to info@dynamicsconsulting.it with what you found, where, and how to reproduce it. For questions about personal data, write to privacy@dynamicsconsulting.it.