Trust centre
This is what we can prove, and when.
We set it out with names and dates: the certifications with their status, where your data lives and who else touches it.
Certifications
| Standard | Status | Date |
|---|---|---|
| GDPR | Active compliance | In force |
| ISO/IEC 27001 | Certification in progress with external audit | Expected |
| ENS | Certification in progress with external audit | Expected |
| NIS2 | Alignment in progress, verified with external audit | Expected |
| ISO 45001 | Certification in progress with external audit | Expected |
| ISO/IEC 42001 | Artificial intelligence management systems | Expected |
Who else touches your data
| Provider | Role | Where | What it receives |
|---|---|---|---|
| DigitalOcean, LLC | Data processor — hosting | United States | The form, on the server that receives it |
| Cloudflare, Inc. | Sub-processor of DigitalOcean — delivery and protection network | United States | The traffic in transit towards the origin. We do not contract it: it comes as part of the hosting |
| Discord, Inc. | Recipient of the internal notification. Not a processor of readable data | United States | A fixed text that always says the same thing, and an encrypted attachment it cannot open |
International transfers
Colombia has no adequacy decision from the European Commission. We say it first ourselves, in those words. What settles that situation are concrete instruments, and these are the three we use: when you write to us through the form there is no Chapter V transfer, because the GDPR applies to us directly under its Article 3(2); storage with DigitalOcean is covered by the EU-U.S. Data Privacy Framework adequacy decision — Implementing Decision (EU) 2023/1795 of ; and work on your systems, by the Article 28 processing agreement with the Article 46 standard contractual clauses.
That agreement is signed before the first access to any system of yours, not after. You ask for it by email at privacidad@gopenux.com and we send it signed.
No tracking, and checkable
The site makes no request to any external domain: no analytics, no third-party fonts, no embeds and no pixel. The Content-Security-Policy header declares default-src 'self' with no exceptions, so the browser enforces it, and you can check it in a minute with the network tab open. Certifications are checked from the outside in the same way: in the public registers of whoever accredits the certifier — ENAC in Spain, UKAS in the UK and the CCN listing for ENS. The full legal detail is in the legal notice and privacy policy.
Where do we start?
Two ways to begin, depending on what you have in front of you today. Answered within one working day.