Why this exists
We believe transparency is not a legal obligation. It is a design principle.
Aporetic builds AI-powered operational systems for industries the technology world has largely ignored — staffing, aquaculture, seafood production, property management, and workforce operations. These are domains where AI errors have real consequences for real people.
This Trust Center exists because the people and organisations who use Aporetic's products deserve to understand exactly how our AI systems work, what they can and cannot do, and where human judgement remains the final word.
"Aporetic doesn't assist. It operates." — but always alongside a human who decides.
This page also serves as Aporetic's transparency notice under Article 50 of the EU AI Act and our broader commitment to responsible AI deployment across all products and services operated under the Aporetic umbrella, including Ulpia.
Core principle
AI informs. Humans decide.
The Aporetic human-in-the-loop commitment
Every consequential action taken by an Aporetic AI system requires explicit human review and approval before it takes effect. This is not a legal workaround. It is a fundamental design decision.
No Aporetic AI system makes final decisions about employment, payroll, worker status, or personnel records without a qualified human reviewing and approving the output.
AI-generated outputs in high-stakes domains are presented as recommendations or analyses — not as decisions — and are clearly labelled as AI-generated.
Authorised users can always override, modify, or reject any AI recommendation. No workflow can be configured to bypass this.
In domains classified as high-risk under the EU AI Act — including workforce management and payroll — human-in-the-loop review is a mandatory system requirement, not an optional feature.
This approach is central to Aporetic's identity and is reflected in our Usage Policy, Terms of Service, and all product design decisions. We believe AI systems that remove human judgement from consequential decisions are not ready for the industries we serve.
What AI is used for
How we use AI across our products
Aporetic is an AI deployer — we integrate foundation models from third-party providers into purpose-built operational tools. We do not develop foundation models ourselves. The following table describes the categories of AI use across our products.
Use category
Description
Human oversight
Timesheet and payroll intelligence
AI reads, classifies, and maps employee timesheet data from multiple client formats. Flags anomalies and generates payroll-ready outputs.
All outputs reviewed and approved by a human payroll administrator before submission.
Workforce data processing
AI assists in matching employee records, candidate data, and assignment information via staffing platform integrations.
Human operator confirms all matches. AI never writes to source systems without human confirmation.
Operational data analysis
AI analyses production, inventory, and intake data in aquaculture and seafood processing contexts to surface patterns and recommendations.
Recommendations presented to human operators. All production decisions made by qualified personnel.
Compliance intelligence
AI assists in generating, reviewing, and monitoring compliance-related documents and obligations.
All compliance outputs reviewed by qualified personnel before use or submission.
Conversational AI interfaces
AI-powered chat interfaces within Aporetic products assist users with queries, data retrieval, and task execution.
Disclosed to users at the start of each session. Human escalation available at all times.
Content generation (Ulpia)
AI assists in generating creative and social content under the Ulpia brand.
All published content reviewed by a human before publication.
Aporetic does not use AI for: social scoring, real-time biometric identification, predictive policing, manipulation of individual behaviour, or any use classified as prohibited under the EU AI Act.
Aporetic's high-risk deployer position
Aporetic acknowledges that AI systems used in workforce operations — timesheet processing, employee data matching, worker allocation, and staffing platform integrations — are high-risk AI systems under Annex III of the EU AI Act. The Article 6(3) exemption for narrow procedural tasks does not apply because these systems involve profiling under GDPR Article 4(4): automated processing of personal data to evaluate aspects of individuals including suitability and work performance.
Under Article 3, any entity that deploys an AI system under its authority — including configuring or relying on a third-party tool — is a deployer subject to the full high-risk obligation suite. Compliance obligations cannot be passed to technology vendors.
We treat this classification as an operational and ethical responsibility, not merely a legal one. All applicable high-risk obligations are implemented by design across our workforce and payroll products.
Transparency
The AI models we use
Aporetic uses foundation models from the following providers, accessed via their APIs. We do not train these models on customer data. All providers are accessed under terms that prohibit using our data to train or improve their models.
Anthropic
Claude (various versions)
Primary AI reasoning, analysis, document processing, and conversational interfaces across Aporetic products.
OpenAI
GPT (various versions)
Supplementary AI capabilities for specific features requiring alternative model characteristics.
Google
Gemini
Selected product features where Gemini's capabilities are specifically advantageous.
xAI
Grok
Selective use for specific analytical features.
Mistral AI
Mistral (various)
EU-based model provider used for select features. Governed directly by GDPR.
Not all providers are active in all products at all times. The full sub-processor list including AI providers is maintained at aporetic.ai/legal/subprocessors.
How we use these models
Aporetic accesses all AI models via their APIs. We do not fine-tune, retrain, distil, or otherwise substantially modify any foundation model. Under the EU AI Act, this means GPAI model provider obligations remain with the upstream providers — Anthropic, OpenAI, Google, xAI, and Mistral — all of whom have signed the GPAI Code of Practice and committed to supporting downstream operators.
What Aporetic does on top of these models — system prompts, custom instructions, retrieval-augmented generation (RAG), and purpose-built interfaces — constitutes insubstantial modifications under the Act. These techniques do not alter the underlying model's architecture, generality, capabilities, or risk profile.
We maintain internal technical documentation of our AI architecture and integration approach as a governance best practice, regardless of whether it is formally required. We review this documentation when integrating new models or making material changes to our AI systems.
Branded AI products
Ulpia Model, Frontier Model, and what branded AI means for compliance
Aporetic and its affiliated brand Ulpia are developing branded AI products — including Ulpia Model (a consumer-facing AI under the Ulpia brand) and Frontier Model (a multi-model intelligence layer under the Aporetic brand). This is a deliberate product decision and it carries specific compliance implications we address openly here.
Placing an AI system on the market under your own name or trademark — regardless of whether you built the underlying model — makes you a provider of that system under Article 25 of the EU AI Act. We know this, we accept it, and we build accordingly.
What this means in practice
Ulpia Model and Frontier Model are powered by foundation models from third-party providers — Anthropic, OpenAI, and others — accessed via API and orchestrated through Aporetic's intelligence layer. We do not modify the underlying models. However, by presenting these as branded products under our own names, we accept provider obligations for the AI systems we place on the market.
The specific obligations depend on how these products are used:
Product
Primary use context
Risk classification
Key obligations
Ulpia Model
Consumer-facing creative AI — content generation, social, community
Minimal / limited risk
Article 50 disclosure (AI interaction, AI-generated content labelling). Never deny being AI. Human review before publication.
Frontier Model
Multi-model orchestration for business and operational contexts
Assessed per use case — high-risk if used in Annex III contexts
Article 50 disclosure. High-risk obligations applied where use case triggers Annex III classification. Human-in-the-loop maintained throughout.
What we commit to as branded AI providers
- All interactions with Ulpia Model and Frontier Model clearly disclose AI involvement at the point of interaction.
- AI-generated content produced by our branded models is labelled as AI-generated where published.
- Neither Ulpia Model nor Frontier Model will ever claim to be human when sincerely asked.
- Where branded models are used in high-risk contexts — employment, HR, workforce, compliance — all high-risk deployer and provider obligations apply, including human oversight, bias monitoring, logging, and candidate/worker disclosure.
- We maintain internal technical documentation of the architecture, orchestration layer, and integration scope for each branded model product.
- If we ever fine-tune or substantially modify a foundation model for use in a branded product, we will conduct a full compliance assessment before deployment and update this Trust Center accordingly.
The multi-model intelligence layer
Part of Aporetic's vision is orchestrating multiple AI models — Claude, GPT, Gemini, Grok, and others — working together within a single intelligence layer. From a compliance perspective, the orchestrating system is itself an AI system under the EU AI Act's definition. Aporetic accepts provider obligations for the orchestration layer as a whole, while the individual model providers retain obligations for their underlying models. Our sub-processor list at aporetic.ai/subprocessors documents all model providers in this layer.
Honest about AI
What our AI systems may get wrong
We believe being honest about AI limitations is as important as communicating its capabilities. The following are known limitations of AI systems as deployed in Aporetic's products.
Factual accuracy
AI outputs may contain inaccuracies, outdated information, or confident-sounding errors. Always verify consequential factual claims independently.
Consistency
Identical inputs may produce different outputs across sessions. AI systems do not guarantee deterministic responses.
Domain expertise
AI lacks the lived expertise of industry specialists. Outputs in specialised domains require review by qualified professionals.
Context limitations
AI systems have finite context windows and may not retain or correctly apply information from earlier in a conversation or document.
Bias
Foundation models may reflect biases present in their training data. We monitor for and mitigate known bias patterns in our operational tools.
Novel situations
AI performance may degrade in situations significantly outside its training distribution. Edge cases require additional human scrutiny.
These limitations reinforce why Aporetic's human-in-the-loop design is non-negotiable in high-stakes operational contexts.
Data and privacy
What data we collect and how AI uses it
Aporetic processes personal data in its role as a data processor on behalf of its customers. Our AI systems process only the data necessary to deliver the relevant service.
No training on customer data
Aporetic does not use customer data or AI inputs/outputs to train or fine-tune any AI model — Aporetic's own or any third-party provider's.
API-only model access
All AI model providers are accessed via API, under terms that prohibit using API data for model training by default.
Data minimisation
Only the data required to perform the specific AI task is submitted to AI models. Sensitive personal data is handled with additional controls.
EEA data preferences
Where available, Aporetic prefers EU-region infrastructure and EU-based model providers to minimise cross-border data transfers.
Retention
AI-processed data is retained only as long as necessary to deliver the service. Customer data is deleted or returned within 30 days of termination on request.
Full details in our Privacy Policy and Data Processing Agreement.
Your rights
What you can control
Users and customers interacting with Aporetic's AI systems have the following rights and controls.
Know you're using AI
Every AI-powered interface clearly identifies itself as AI at the start of interaction. We never instruct our AI to claim to be human.
Request human review
Any AI recommendation or decision affecting you can be escalated to a human reviewer. This right cannot be waived.
Explanation of decisions
Where AI has supported a decision affecting you, you have the right to request an explanation of what the AI assessed and recommended.
Data access and deletion
You may request access to, correction of, or deletion of your personal data at any time via our
data request form.
Withdraw consent
Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
Contest AI outputs
You may contest any AI-generated output that affects you. Contact
[email protected] to initiate a review.
To exercise any of these rights: [email protected] or aporetic.ai/legal/data-request.
Infrastructure
How we protect AI-processed data
Data processed through Aporetic's AI systems is protected by the following technical and organisational measures.
Encryption
AES-256 at rest. TLS 1.2+ in transit. All AI API calls made over encrypted connections.
Access controls
Least-privilege access. MFA required for administrative access. Role-based permissions throughout.
Infrastructure
Hosted on AWS and Google Cloud with EU-region preference. Supabase Ireland for primary database. Norwegian infrastructure where available.
Incident response
72-hour breach notification to affected customers. Documented incident response procedures. Regular security reviews.
Vulnerability disclosures: [email protected]. Security documentation: aporetic.ai/legal/dpa (Schedule 2).
Internal governance
How we govern AI internally
Governance area
Our approach
AI inventory
We maintain an internal inventory of all AI systems deployed across Aporetic products, including their purpose, risk classification, and applicable obligations.
Risk classification
Each AI use case is assessed against EU AI Act risk tiers. Workforce and payroll tools are treated as high-risk by design, with corresponding controls applied regardless of formal classification.
AI literacy
All Aporetic personnel working with AI systems receive training on AI capabilities, limitations, and responsible use in accordance with Article 4 (AI literacy) of the EU AI Act.
Supplier oversight
All AI model providers are evaluated for safety practices, data protection compliance, and EU AI Act obligations before integration. We ask providers to confirm conformity assessment status and request technical documentation and bias audit results where available.
Bias monitoring
For AI systems handling workforce and candidate data, we monitor for discriminatory patterns across protected characteristics. Input data quality is reviewed to ensure it is relevant and representative — a substantive obligation under the Act, not a checkbox.
Activity logging
Logs of high-risk AI system activity are retained for a minimum of six months in accordance with EU AI Act deployer requirements. These logs support audit, oversight, and incident investigation.
Continuous monitoring
AI system performance and outputs are monitored for unexpected behaviour, bias, and policy violations on an ongoing basis. Incidents are documented and reviewed.
Candidate and worker disclosure
Where AI systems inform decisions affecting candidates or workers, those individuals are informed before processing occurs — at the point of interaction, not buried in terms. They are informed of their right to request an explanation of any AI-assisted decision under Article 86.
Product design principles
Human-in-the-loop by default. Minimum necessary data. Clear AI disclosure at all interaction points. Override and escalation available at all times. Oversight personnel are trained and have formal authority to override AI outputs.
Regulatory compliance
EU AI Act — Aporetic's compliance position
Aporetic is an AI deployer under the EU AI Act — we integrate foundation models from third-party providers into operational products, rather than developing foundation models ourselves. The following table summarises our obligations and compliance status.
Obligation
Article
Applies to Aporetic
Status
Disclose AI interaction to users
Art. 50(1)
Yes — all consumer-facing AI interfaces
Implemented
Label AI-generated content
Art. 50(2)
Yes — where AI content is published
Implemented
Disclose emotion recognition
Art. 50(3)
No — Aporetic does not deploy emotion recognition
Not applicable
Label deepfake / synthetic media
Art. 50(4)
Yes — if synthetic media features are added
Monitored
AI literacy for staff
Art. 4
Yes — all personnel working with AI
Implemented
Human oversight for high-risk AI
Art. 14
Yes — workforce and payroll tools treated as high-risk by design
Implemented
Prohibited AI practices ban
Art. 5
Yes — full prohibition on all banned practices
Compliant
Disclose AI use to affected candidates and workers before processing
Art. 26(7)
Yes — all workforce and staffing AI tools
Implemented
Provide explanation of AI-assisted decisions on request
Art. 86
Yes — any AI-assisted decision affecting individuals
Implemented
Retain AI system activity logs for minimum 6 months
Art. 12 / 26
Yes — all high-risk AI systems
Implemented
Bias testing and data quality monitoring
Art. 10 / 26
Yes — workforce and candidate data systems
Implemented
Trained human oversight with authority to override
Art. 14
Yes — all high-risk AI systems
Implemented
High-risk system registration
Art. 49
Monitored — depends on formal classification outcome
Under review
GPAI model obligations
Art. 53–55
No — Aporetic does not fine-tune, retrain, or substantially modify foundation models. GPAI provider obligations remain with upstream providers. Aporetic uses API access, prompt engineering, and RAG — insubstantial modifications under the Act.
Not applicable
Technical documentation of AI architecture
Best practice
Aporetic maintains internal documentation of its AI integration architecture and modification scope as a governance best practice, following the conservative approach recommended by the EU AI Office for downstream operators.
Implemented
Aporetic treats its workforce and payroll AI tools as high-risk by design — applying human-in-the-loop controls, disclosure requirements, and oversight mechanisms regardless of formal regulatory classification. We believe this is the right approach for AI that touches people's livelihoods.
Key EU AI Act deadlines and Aporetic's position:
February 2025
Prohibited practices ban effective. Aporetic compliant — none of our systems engage in prohibited practices.
August 2025
GPAI model obligations effective. Applies to providers like Anthropic and OpenAI, not to Aporetic as deployer.
August 2026
Article 50 transparency obligations and high-risk system requirements fully effective. Aporetic's human-in-the-loop design already compliant.
Ongoing
We monitor EU AI Office guidance, codes of practice, and implementing legislation. This page is updated as requirements evolve.
Questions about our AI systems?
We welcome questions about how Aporetic uses AI, our safety practices, and our compliance approach.