This website. Vercel deployment — not the campus.
§ 00 Trust Center · Portal
Trust and Security Portal
Copperway is live software. The Vasilikos campus is pre-construction. This portal is where we publish what we actually operate, what is still design work, and which certifications we do not hold.
AGICY is the project operator of Copperway and the planned Vasilikos RISC-V campus in Cyprus. This page is the public record for buyers, counsel, and researchers — not a certificate locker and not a live offtake.
Mature trust portals show a wall of attestations. Ours shows status. Live means operated today. Design note means a public alignment page. Target means a roadmap item. Not held means do not write it into a vendor questionnaire as fact.
Start your security review
Request the NDA pack via Contact, or use the counsel-gated institutional path. We do not run a self-serve document locker.
Portal updated 29 August 2026
Gateway, playground, API keys. Not Vasilikos silicon.
Partner-supplied hours until COD.
Pre-construction. No live hall, SOC, or HSM.
§ 01 Compliance · Status, not a locker
What we hold, design, and refuse to fake
Each plate is a status, not a logo wall. Live means operated today. Design note means a public alignment page. Target means a roadmap item. Not held means do not write it into a vendor questionnaire as fact.
Live
Copperway gateway
OpenAI-compatible routing, playground, and API keys — not campus silicon.
Design noteGDPR
Public processor-design note. Not a certificate.
Design noteNIS2
Public readiness note for a future essential-entity path.
Design noteDORA
Public ICT-risk design note for financial-sector buyers.
Design noteEU AI Act
Public risk-tier and transparency cooperation note.
Target
ISO/IEC 27001
ISMS target. Not certified.
Target
SOC 2 Type II
Audit target. Not attested.
Not held
FedRAMP / HIPAA / CMMC
Not claimed. Do not treat this portal as a US accreditation pack.
§ 02 Documents · Public · NDA
Featured documents
Public pages are linked. NDA items are a request, not a download. We do not run a self-serve locker yet.
Public · Legal
Privacy Policy
Controller status, processing, and contact. AGICY is operated under the AGICY brand by Advanced Governance & Intelligence Cyprus, the operator of agicy.ai.
Public · Data privacyGDPR Art. 28 design note
Processor-design status for EU personal data.
Public · CorporateEthics & charter
Civilian mandate and responsible-use policy.
Public · ReportsCLOUD Act research brief
Why US-parented clouds remain reachable even on EU soil.
Public · Application securityWebsite security scanner
Public header/TLS checker. Not a pentest of Copperway or the campus.
NDA · Self-assessmentsSecurity questionnaire (CAIQ-style)
Not published. Request under NDA via Contact.
Document library
- Privacy PolicyPublic · Legal
Controller status, processing, and contact. AGICY is operated under the AGICY brand by Advanced Governance & Intelligence Cyprus, the operator of agicy.ai.
- Website TermsPublic · Legal
Use of agicy.ai and related public services.
- Cookie and storage policyPublic · Legal
Consent categories and retention.
- SRA termsPublic · Legal
Reservation interest — not a live offtake or token sale.
- Gateway pricing disclaimerPublic · Legal
How Copperway prices are labelled.
- GDPR Art. 28 design notePublic · Data privacy
Processor-design status for EU personal data.
- NIS2 design notePublic · Compliance
Network and information-security design status.
- DORA design notePublic · Compliance
Digital operational resilience design for financial ICT.
- EU AI Act design notePublic · Compliance
Risk-tier alignment and transparency cooperation.
- Data Embassy design notePublic · Compliance
Jurisdictional isolation concept — not a live embassy.
- Partner agreementPublic · Legal
Public partner template.
- Ethics & charterPublic · Corporate
Civilian mandate and responsible-use policy.
- CLOUD Act research briefPublic · Reports
Why US-parented clouds remain reachable even on EU soil.
- Website security scannerPublic · Application security
Public header/TLS checker. Not a pentest of Copperway or the campus.
- Editorial methodologyPublic · Reports
How claims are sourced and corrected.
- Security questionnaire (CAIQ-style)NDA · Self-assessments
Not published. Request under NDA via Contact.
- Pentest / SOC packNDA · Reports
No public attestation letter. Shared only if and when an engagement exists.
- Institutional data roomNDA · Legal
Counsel-gated IR path. Not a consumer security download.
§ 03 Processors · Public list
Sub-processors today
This is the public list for the website and Copperway. It is not a campus sub-processor register and not a Financial Close DPA pack. Transfers outside the EEA, where they occur, rely on SCCs and the measures described in the Privacy Policy. We do not sell personal data.
| Processor | Purpose | Location | Status |
|---|---|---|---|
| Stripe, Inc. | Payment processing (PCI DSS) | EU / US (SCCs) | Live |
| Vercel, Inc. | Application hosting and edge for agicy.ai | EU region | Live |
| Supabase, Inc. | Authentication and database | EU region | Live |
| Neon, Inc. | PostgreSQL (Playground, audit logs) | EU region | Live |
| Cloudflare, Inc. | Turnstile bot protection when enabled | EU / US (SCCs) | Live |
| Transactional email provider | Account and service notifications | EU region (TBD) | Design note |
| Bridge GPU marketplace supplier | On-demand GPU (Bridge Compute only — not Vasilikos campus) | EU placement filters; vendor jurisdiction varies | Live |
| Upstream model APIs (Copperway) | Inference after the PII vault. Provider set can include US-parented APIs. | Varies — not campus | Live |
Full legal wording lives on the Privacy Policy. Copperway model hops are listed here because they are not named as a single vendor in that table.
§ 04 Controls · Catalogue
Control catalogue
Same shape as a mature trust portal — product, privacy, legal, access, network, infrastructure — with live vs design labelled so a buyer questionnaire is not filled from campus prose.
Product — Copperway
Live OpenAI-compatible API
Proxy keys from the dashboard. Playground is signed-in and does not use those keys.
Live Query limits
Playground: 15 messages and 25,000 billed tokens per day per signed-in account (resets midnight UTC). Paid credits are not a live wallet yet.
Data privacy
Design note Campus data residency
Vasilikos compute is pre-COD. Do not treat this site as EU-sovereign cluster storage.
Data security
Design note Campus backups / HSM
Target architecture for COD. No live cluster backup attestation.
Access control
Design note Campus RBAC / mTLS fabric
Target architecture for COD — not a live cluster control plane.
Production infrastructure
Live This website
Public site is a Vercel deployment. That is not the planned campus.
Design note Vasilikos facility
Pre-construction. No 24/7 SOC, HSM, or biometric hall is operating.
Application security
Live Vulnerability reports
Email security@agicy.ai. See our coordinated disclosure policy. No public bug-bounty programme is advertised.
Legal
Design note Campus DPA / security addendum
Not published. Request under NDA if you need a draft for counsel review.
Network security
Design note Campus IDS / firewall fabric
Target for COD. Not a live hall network diagram.
Endpoint security
Not held Corporate EDR / disk encryption programme
No public workforce endpoint pack. Do not infer one from this portal.
Corporate security
Not held 24/7 campus SOC
Campus is pre-construction. No operations centre is running.
Policies
Target ISMS policy set
ISO 27001 roadmap. Not an issued Statement of Applicability.
§ 05 Security grades · Independent scans
Independent grades
We link the scanners. We do not paste last week's letter grade as if it were a certificate.
SSL Labs
Independent TLS grade for agicy.ai. We do not restate scores here — open the scan.
Security HeadersIndependent response-header grade. Re-run after deploys.
Mozilla ObservatoryIndependent observatory scan of agicy.ai.
HSTS PreloadCheck whether agicy.ai is on the preload list. We do not claim membership here.
§ 06 Bulletins · When we have one
Trust portal updates
No numbered product bulletins are published yet. When Copperway, this website, or (later) campus compute has a security advisory, it will be listed here with an ID, date, and affected surface. Report issues to agi@agicy.ai.
§ 07 Mandate · Use policy
Civilian public benefit only
AGICY is a civilian and humanitarian programme: healthcare, education, emergency management, climate resilience, citizen services, and related enterprise use. No weapons, targeting systems, or conflict-command AI. No weapons-programme revenue assumptions.
§ 08 FAQ · On the record
Frequently asked questions
Does AGICY hold ISO 27001 or SOC 2?
No. Those are targets on the certification roadmap. This portal will say “held” only when an attestation exists. Until then, treat ISO 27001 and SOC 2 Type II as not held.
Is Copperway the same as the Cyprus campus?
No. Copperway is live gateway software. The Vasilikos RISC-V campus is pre-construction. Upstream model APIs used by Copperway may still be US-parented.
Does the US CLOUD Act reach AGICY?
The CLOUD Act can reach data held by US-controlled providers even on EU servers. AGICY’s operator design is a Cyprus EU path without a US parent for planned campus compute — not legal advice. Copperway vaults PII before hops that may still use US model APIs. See the CLOUD Act brief.
Where is the sub-processor list?
On this portal, matching the Privacy Policy table, plus Copperway upstream model APIs. It is the public website/Copperway list — not a campus DPA register and not a Financial Close pack.
How do I get NDA documents?
Use Contact us and say you need a security pack. Institutional IR uses the counsel-gated data-room path. We do not run a self-serve NDA locker yet.
How do I report a vulnerability?
Email security@agicy.ai with enough detail to reproduce. Read the coordinated disclosure policy at /legal/security-disclosure. We aim to acknowledge within 72 hours. There is no public bounty table.
§ 09 Access · NDA · IR
Request access or report
Security packs go through Contact. Institutional diligence goes through the counsel-gated data room. SRA is reservation interest — not a trust attestation.