Regulated Institutions | Deterministic Execution Governance

🏦

Tier-1 Investment Bank

50,000+ DAILY TRANSACTIONS · 6 JURISDICTIONS · €10B+ BALANCE SHEET

MiFID II EMIR FATF DORA

EXAMPLE TRANSACTION

Cross-Border M&A Pre-Clearance — €340M

US private equity fund acquires German mid-market company with subsidiaries in CH, UK, SG. Applicable laws: KWG, GwG, GDPR, MiFID II, EMIR, OFAC, BSA, FCPA, FINMA, FCA, MAS. Transaction volume: €340M across real estate, derivatives and bank accounts in 4 jurisdictions.

IDENTITY

Identity Verification

LEI verification PE fund + target company. UBO structure per 6AMLD Art. 3. ZKP-KYC generated — no PII disclosed.

PASS

SANCTIONS

Sanctions Screening

OFAC SDN, EU Consolidated, UN, HMT, BaFin, MAS — 9 lists simultaneous. 50%-rule checked. All CLEAR.

CLEAR

JURISDICTION

Jurisdiction Analysis

4 conflicts detected: GDPR vs. CLOUD Act → EDPB framework. FATCA vs. CH banking secrecy → mutual assistance treaty. MiFID II vs. FIDLEG → CH exemption. All 4 resolved.

4/4 RESOLVED

FRAMEWORKS

Framework Compliance

23 frameworks checked: GDPR, DORA, MiFID II, EMIR, KWG, GwG, FATF, OFAC, FINMA, FCA, MAS, FCPA, BSA — all PASS.

23/23 PASS

RISK

Risk Scoring

Country risk: DE/US/CH/SG all FATF-compliant. Transaction risk: High Value (1.4×), Cross-Border (1.2×), M&A type (1.3×). Total score: 42/100 MEDIUM.

42/100 MEDIUM

AUTHORITY

Authority Chain

Maker: Senior Dealmaker (SEC experience). Checker: Head of Compliance (BaFin experience). GLD score: 0.84 — high epistemic independence. Delegation chain complete.

GLD 0.84

EVIDENCE

Evidence Sealing

Merkle root calculated. QES per eIDAS Art. 27 (PAdES LTA). RFC-3161 timestamp. CRYSTALS-Dilithium post-quantum signature. 22.4 MB artifact bundle.

SEALED

WORM

WORM Commit

Block #84,291. Frankfurt (Primary) → Dublin → Amsterdam. 10-year retention. Immutable. Bi-temporal: valid_time + system_time.

COMMITTED

VERDICT

Verdict Issuance

847 decision rules. All gates PASS. No BLOCK, no unresolved conflicts. Warranty Token issued. Valid 24 hours.

✓ PASS

PASS

WARRANTY TOKEN ISSUED

Designed for judicial review, WORM-sealed, post-quantum-secure

47ms

Total latency

Frameworks

4/4

Conflicts resolved

280 FTE

Compliance staff savings

€180M

Eliminated fine risk

Sealed Evidence

Per Determination

🏛️

Central Bank & CBDC

80M CITIZENS · 12M DAILY TRANSACTIONS · SOVEREIGN DATA CONTROL

CBDC FATF GDPR ZKP Privacy

EXAMPLE SCENARIO

CBDC Privacy Layer — 80 Million Citizens

A European central bank launches a CBDC. The fundamental dilemma: full privacy for citizens (GDPR) vs. full AML/FATF compliance. Classical technology can only do one. immo.quick Core solves both simultaneously.

IDENTITY

ZKP Privacy Mode — under €1,000

Small amount €4.50 (coffee): ZKP proof 'AML-checked and CLEAR' — without disclosing name, address or identity. FATF-compliant. GDPR-compliant. Simultaneously.

ZKP PASS

SANCTIONS

Anonymous Sanctions Screening

Sanctions check via ZKP batch processor. No name transmitted. Cryptographic proof that the entity does not match any checked sanctions list, without transmitting PII.

CLEAR

JURISDICTION

JIT Regulator Access

For high amounts >€10,000: standard KYC. For tax authorities: JIT access only with judicial order, for exactly this transaction, time-limited, fully audited.

SOVEREIGN

FRAMEWORKS

GDPR + FATF simultaneously

GDPR Art. 5 (data minimization): ✓ via ZKP. FATF R.16 (Travel Rule): ✓ for >€1,000. ePrivacy: ✓. No conflict — resolved through cryptographic separation.

DUAL PASS

G5-G9

VERDICT

Automatic WORM Commit + Warranty Token

12 million transactions daily. Each processed in under 500ms. Each WORM-sealed. No citizen identified — except with court-ordered JIT access.

✓ PASS

PASS

PRIVACY + AML SOLVED SIMULTANEOUSLY

Strongest privacy level worldwide · 100% FATF-compliant

<500ms

Per transaction

12M

Daily

PII disclosed

100%

FATF compliance

Citizen PII disclosed

Technical Cloud Act Shielding

EU-TEE Frankfurt

🏢

Real Estate Investment Company

€2.4BN AUM · 127 PROPERTIES · DE/AT/CH · 23 INSTITUTIONAL INVESTORS

GwG EU Taxonomy SFDR CSRD

EXAMPLE TRANSACTION

Office Building Munich — Acquisition €47M

Acquisition of an office building in Munich, €47M. GwG identification, EU Taxonomy assessment, escrow processing and SFDR reporting for all 23 investors — fully automated.

T+0

GwG KYC

GwG identification seller + buyer

Digital, ZKP-based. No appointment. No notary for KYC. UBO determination §3 GwG. Result: 4 minutes instead of 4-6 weeks.

4 Min.

T+0

REG TWIN

Regulatory Twin™ — 27 Frameworks

GwG, KWG, GDPR, BDSG, GrEStG, WpHG, EU-Taxonomy, SFDR, CSRD — all simultaneous. No jurisdiction conflict DE/DE. Risk score: LOW.

PASS

T+0

TAXONOMY

EU Taxonomy Assessment

EPC class B, top-18% national stock → NOT taxonomy-compliant. Recommendation: roof renovation €380K → EPC class A, top-12% → taxonomy-compliant. NPV premium: +€1.4M over 10 years.

ACTION

T+0

ESCROW

Smart Escrow — no human trustee

Conditions: land registry entry AND handover protocol AND financing confirmation. Automatic release €47M upon fulfillment. WORM-sealed.

CONFIGURED

T+53

CLOSING

Land registry entry → automatic escrow release

Land registry entry completed. System detects automatically → €47M transfer triggered. All 23 investors automatically receive SFDR-compliant reporting. WORM artifact bundle to all parties.

EXECUTED

PASS

FULLY AUTOMATED

GwG · EU Taxonomy · Escrow · SFDR — no manual intervention

4 Min.

KYC instead of 6 weeks

€0

EU Taxonomy costs

47 Tage

Until closing

€0

EU Taxonomy instead of €15,000/property

4 Min.

GwG KYC instead of 6 weeks

Auto

SFDR reporting for all investors

🛡️

Insurance Company

SOLVENCY II · IDD · GDPR ART. 22 · PARAMETRIC TRIGGERS

Solvency II Parametric IDD

EXAMPLE SCENARIO

Cyber-Parametric Insurance — Ransomware Trigger

An SME suffers a documented ransomware attack. The parametric insurance pays automatically in under 4 hours — without manual claims adjuster, with complete cryptographic proof of the entire causal chain.

ORACLE

Sovereign Oracle — Ransomware Proof

CISA KEV Database + VirusTotal + MITRE ATT&CK — cryptographically attested. Data sealed before entering trigger algorithm. Oracle manipulation excluded.

VERIFIED

TRIGGER

Parametric Trigger — Condition Fulfillment

Insurance contract: 'Documented ransomware attack on insured infrastructure → payout €X'. Condition met. Trigger fired. No human decides.

TRIGGERED

COMPLIANCE

Solvency II + IDD + GDPR Art. 22

Capital requirements checked. IDD information obligations fulfilled. GDPR Art. 22 (automated decision): documented and explainable. All regulatory requirements PASS.

COMPLIANT

PAYOUT

Automatic Payout + Artifact Bundle

Payout triggered. Complete WORM artifact: attack → oracle attestation → trigger decision → insurance contract → payout. Immediately available for reinsurers and regulators.

EXECUTED

PASS

PAYOUT IN <4 HOURS

No claims adjuster · Full causal proof · Reinsurer-ready

<4h

Payout

Manual interventions

100%

Proof chain

<4h

Instead of weeks

3 Mon.

Regulatory approval instead of 18

€0

Claims adjuster costs

⚡

FinTech & Payments

PSD3 · MiCA · eIDAS 2.0 · 50,000 DAILY TRANSACTIONS · 140 ORIGIN COUNTRIES

PSD3 MiCA FATF Travel Rule

EXAMPLE SCENARIO

Cross-Border Remittance — 50,000 Transactions Daily

A remittance FinTech: 50,000 daily transactions (avg. €400), customers from 140 countries, destination countries in 80 countries — 11,200 jurisdiction combinations. The biggest problem: correspondent banks terminating relationships due to compliance risk (de-risking).

BATCH AML

ZKP Batch-AML for all 50,000

Fully automatic AML screening via ZKP-based batch processor. No PII transmitted. Proof: every transaction AML-checked and CLEAR — without privacy violation.

50K CLEAR

TRAVEL RULE

FATF Travel Rule — automatic from €1,000

For all transactions >€1,000: automatic Originator/Beneficiary data standardization per ISO 20022, designed to support FATF Travel Rule requirements without manual intervention.

ISO 20022

11.200 JUR.

11,200 Jurisdiction Combinations — automatic

The system knows all 140×80 jurisdiction combinations and applies the correct rules — without manual configuration. PSD3, MiCA, eIDAS 2.0 as API layer.

AUTO

DE-RISKING

De-Risking solved — full compliance documentation

Correspondent banks receive on request: complete WORM artifact bundle of all compliance checks. Mathematically provable. No room for interpretation. De-risking risk eliminated.

SOLVED

PASS

DE-RISKING PROBLEM SOLVED

11,200 jurisdictions · FATF Travel Rule · PSD3 — fully automated

50K

Processed daily

11.200

Jurisdictions auto

3 Mon.

Regulatory approval

3 Mon.

Instead of 18 months regulatory approval

De-risking risk

11.200

Jurisdictions automatically

💼

Private Equity & Family Office

PORTFOLIO COMPLIANCE · D&O EVIDENTIARY RISK REDUCTION · CROSS-BORDER M&A · SOVEREIGN CAPITAL

AIFMD DORA Art. 5 D&O Evidence

EXAMPLE SCENARIO

Portfolio Compliance + Defensible C-Level Evidence

A PE fund with €2.4bn portfolio in 12 countries. The managing partner is personally liable under DORA Art. 5, AIFMD and local corporate laws. The question: How does a managing partner prove they personally exercised due care, with evidence designed for judicial and regulatory review, for every portfolio decision?

LIABILITY

Delegation Chain Evidence, for every manager

The system documents, individually for the Managing Partner, CFO and CCO, the complete delegation chain of a decision, WORM-sealed, separately for each governance actor. No calculated liability score.

MEASURED

GLD SCORE

GLD-Score — Governance Logic Divergence

Maker-checker pair: Managing Partner (US background) + CCO (BaFin background). High regulatory tradition divergence. Low network proximity. GLD: 0.84 — full maker-checker validity.

GLD 0.84

D&O EVIDENCE

Defensible Decision Evidence for Governance Actors

For every portfolio decision: WORM-sealed evidence that the managing partner made the decision under the rule version in force at the time, with correct delegation, reviewed by an independent checker. No claim about insurance premiums or legal liability relief.

EVIDENCED

PORTFOLIO

Portfolio-wide compliance — 12 countries simultaneous

AIFMD, ELTIF, EMIR, local corporate laws in 12 jurisdictions — all portfolio companies simultaneously checked. Regulatory Twin™ for all investment decisions.

12/12 PASS

PROTECTED

C-LEVEL PERSONALLY PROTECTED

Managing Partner · CFO · CCO — all with measurable liability distance

Sealed Evidence

Delegation Chain per Decision

Liability gaps

Countries simultaneous

Sealed Evidence

Delegation Chain per Decision

Sealed Evidence

Delegation Evidence per Decision

Sealed Evidence

Per Determination

🌐

Governments & Regulators

NATIONAL DATA SOVEREIGNTY · AIR-GAP · CLOUD ACT SHIELDING · SANCTIONS ENFORCEMENT

Sovereign Air-Gap Cloud Act Shielding

EXAMPLE SCENARIO

National Sanctions Enforcement — EU Member State

An EU member state wants sanctions enforcement at industrial scale — without US jurisdiction, without CLOUD Act access, without external cloud dependency. Air-gap capable for classified environments.

SOVEREIGNTY

Data sovereignty, physically and cryptographically strengthened

All data in EU-TEE Frankfurt (Core). No US cloud provider has access to plaintext data. A technical attestation document is issued, PCR0-attested, not replicable without physical chip access.

SOVEREIGN

AIR-GAP

Air-gap operation — zero external dependencies

All rule sets local. No external network required for core logic. Operable in national data centers without internet connection. GDPR-compliant by design.

AIR-GAPPED

SANCTIONS

Industrial sanctions enforcement

EU Consolidated, UN, national lists — all locally stored, cryptographically integral. Millions of screenings daily. Every hit WORM-sealed and usable for law enforcement.

INDUSTRIAL

FISA SHIELD

FISA Terminal Refusal Protocol

Formal, legally grounded protocol for refusing FISA requests under EU law (ECHR Art. 8, GDPR Art. 48). Documented for subsequent review. For Swiss banks and EU institutions with US clients.

PROTECTED

SOVEREIGN

REDUCED US JURISDICTION EXPOSURE · CLOUD ACT SHIELDING

Air-gap · National data sovereignty · Industrial sanctions enforcement

US jurisdiction

Air-Gap

Capable

Strengthened

Data sovereignty

Shielded

CLOUD Act / FISA

Industrial

Sanctions enforcement

Air-Gap

Classified environments

⚙️

InsurTech Startup

35 EMPLOYEES · DORA · IDD · INSTANT REGULATORY APPROVAL

DORA IDD MiFID II

EXAMPLE SCENARIO

From 0 to Regulatory-Ready in 3 Months

An InsurTech startup, 35 employees, launches a cyber-parametric insurance for SMEs. Problem: DORA, IDD, MiFID II, GDPR, CIRCIA for US clients. Without immo.quick: 6-18 months regulatory approval, €500K+ compliance setup costs. With immo.quick Serverless: 3 months, API integration.

API SETUP

API Integration — 2 weeks

Serverless Edition API integrated. DORA compliance: done. IDD information obligations: automatic. GDPR: by design. No in-house compliance team built.

INTEGRATED

EVIDENCE

300-page Evidence Package — automatic

For regulatory approval: the system automatically generates a complete, WORM-sealed evidence package with all compliance proofs. Regulators receive a mathematically provable application instead of 300 pages of PDFs.

AUTO-GENERATED

APPROVAL

Regulatory Approval — 3 months instead of 18

Regulator receives complete evidence package. No questions about compliance gaps — there are none. Approval in 3 months. Market entry 15 months earlier than competitors.

APPROVED

3 MONTHS INSTEAD OF 18 MONTHS

15 months earlier to market than competitors

3 Mon.

Regulatory approval

€0

In-house compliance team

15 Mon.

Head start

-€500K

Compliance setup costs saved

3 Mon.

Instead of 18 months approval

15 Mon.

Competitive advantage

🏆

International Sport Federation

MULTI-FEDERATION · TRANSFER WINDOWS · ANTI-DOPING · COMPETITION DECISIONS

FFAR WADA Code PSR / FFP ISTI

EXAMPLE SCENARIO

Cross-league governance review, one federation year

A fictional umbrella federation coordinates several national leagues and an anti-doping programme. Rulebooks involved: FIFA Football Agent Regulations, league-specific PSR/FFP rules, WADA Prohibited List, ISTI, ISL. Scope reviewed: transfer window submissions, sample chains, competition decisions.

IDENTITY

Identity Verification

Tenant identity checked per federation, league, club, and licensed agent. Athlete and DCO roles bound via principal tenants.

PASS

SANCTIONS

Sanctions Screening

Involved legal entities checked against consolidated sanctions lists. No hit.

CLEAR

JURISDICTION

Jurisdiction Analysis

FFAR caps cross-checked against diverging national rules (see gateTransfer). No unresolved collision, every divergence documented.

DOCUMENTED

FRAMEWORKS

Framework Compliance

FFAR, the involved league's PSR/FFP, WADA Code Art. 4.1.1, ISTI, ISL checked against each other.

5/5 PASS

RISK

Risk Scoring

Deadline proximity, agent compensation ratio, and PSR headroom weighted as risk factors.

LOW

AUTHORITY

Authority Chain

Four-party signature for transfers, three-signature binding for samples. Delegation chain complete.

COMPLETE

EVIDENCE

Evidence Sealing

PTP atomic-clock timestamp, Merkle chaining, ECDSA-P256 signature per receipt.

SEALED

RETENTION

Retention Commit

10-year retention, crypto-shredding date set for personal data fields.

COMMITTED

VERDICT

Verdict Issuance

All gates PASS. No sanctioning decision made, receipt handed to the competent body.

✓ PASS

PASS

RECEIPT SEALED

Deterministic, Merkle-chained, ten years forensically verifiable

Frameworks

Sport gates

10 J.

Retention

🎥

Professional League, Video Assistant Referee Process

BIAS AND FAIRNESS PROTECTION · EXECUTIVE OVERRIDE FIREWALL

gateSport IFAB Laws of the Game Bias-Analyse

EXAMPLE SCENARIO

Contact decision in the penalty area, final minute of play

Fictional incident, checked against contact initiation, simulation score, player history, team foul pattern, arm trajectory, and temporal neutrality. Match minute and score are deliberately excluded from the assessment.

G20

SIMULATION

Simulation Score

Biomechanical check against expected fall dynamics.

NO BIAS

G24

TEMPORAL

Temporal Neutrality

Match minute and score excluded.

EXCLUDED

G+

OVERRIDE

Executive Override Firewall

No last-minute call registered. No override attempted.

CLEAN

PASS

RECEIPT SEALED

No political pressure detectable, decision forensically documented

Gates

Override attempts

10 J.

Retention

🏎️

Racing Series, Post-Race Investigation

FIA · DMSB · ACO · WEATHER CORRECTION · RACE DIRECTION CONTEXT

gateMotorsport FIA Sporting Code SAE J1349

EXAMPLE SCENARIO

Track limit exceedance under changing weather conditions

Fictional incident, checked against wind correction, air density correction per SAE J1349, and the hard rule that a time penalty is reviewable, a disqualification is not.

WEATHER

Wind Vector Projection

Tailwind component removed based on telemetry.

CORRECTED

AIR DENSITY

Air Density Correction

Reference condition 99 kPa, 25 °C per SAE J1349.

APPLIED

M+

STRUCTURING

Structuring Protection

On affected draft: pause instead of reset.

SAFE

PASS

RECEIPT SEALED

Weather correction documented, federation comparison matrix on file

Federations covered

Weather layers

10 J.

Retention

💊

Anti-Doping Organisation, Sample Chain

WADA CODE · ISTI · ISL · ZERO-KNOWLEDGE TUE PROOF

gateAntiDoping WADA Prohibited List ISO 17025

EXAMPLE SCENARIO

Sample with a filed therapeutic use exemption

Fictional sample, chain gapless, three signatures bound, TUE confirmed via zero-knowledge proof, without the medical diagnosis ever being stored in the receipt.

CUSTODY

Chain of Custody

Physical seal status and three SHA-256 signatures checked.

INTACT

TUE

Blind TUE Proof

Trusted-issuer commitment confirmed, no diagnosis stored.

VALID

THRESHOLD

WADA Threshold Check

Concentration below the Prohibited List threshold.

BELOW

PASS

CLEARED_WITH_VALID_TUE

Proof without disclosure of the diagnosis

Gate stages

Signatures

10 J.

Retention

🔄

Professional Club, Transfer Window Submission

FFAR · PSR / FFP · FOUR-PARTY SIGNATURE · ATOMIC-CLOCK DEADLINE

gateTransfer FIFA FFAR 2023 PSR / FFP

EXAMPLE SCENARIO

Submission shortly before window close

Fictional club, complete four-party signature, agent compensation below the FFAR cap, PSR headroom maintained.

DEADLINE

Temporal Cutoff (PTP)

Atomic-clock-bound submission time before the hard deadline.

ON TIME

MULTI-SIG

Multi-Signature

Buying club, selling club, player, and agent signed.

COMPLETE

FFAR CAP

Agent Compensation Cap

Within the role-dependent cap.

WITHIN CAP

PSR

PSR / FFP

League-specific financial sustainability maintained.

WITHIN THRESHOLD

PASS

TRANSFER_SEALED

Four parties cryptographically bound, subsequent manipulation excluded

Gates

Signatures

10 J.

Retention

📱

Social Media Platform, VLOP Status

DSA · COPPA · 45M+ EU USERS · TERNARY VERDICT

gateSocialMediaLaws DSA 2022/2065 COPPA

EXAMPLE SCENARIO

VLOP designation with an overdue transparency report

Fictional platform with 51 million monthly active users in the EU. Risk assessment filed, transparency report overdue, no targeted advertising to minors detected.

VLOP

VLOP Threshold

Designation under Art. 33 DSA, risk assessment under Art. 34/35 filed.

FILED

MINOR ADS

Minor-Targeted Ads

No targeted advertising to minors, Art. 28(2) DSA.

CLEAR

TRANSPARENCY

Transparency Report

Periodic report overdue, Art. 24/42 DSA.

OVERDUE

WARN

DSA_TRANSPARENCY_REPORT_OVERDUE

A warning, not a ban, the platform keeps running

Sub-gates

Warning

10 J.

Retention

🎵

Music Label, Release Clearance

SPLIT SHEET MULTI-SIG · AI ACT ART. 50 · SAMPLE/SYNC CLEARANCE

gateMusicCompliance DSM 2019/790 ECDSA-P256

EXAMPLE SCENARIO

Release submission with four parties

A fictional label submits a release, songwriter, producer, lyricist, and label each sign a share, sum exactly 100 percent, one sample fully cleared, no AI material in the track.

IDENTITY

Identity Verification

Label tenant identity checked, public keys of all four parties registered.

PASS

FRAMEWORKS

Framework Compliance

Split sheet sum exactly 100.000 percent, AI Act Art. 50 not applicable, sample clearance fully covered.

3/3 PASS

EVIDENCE

Evidence Sealing

Four ECDSA-P256 signatures checked against the submission's intent hash.

SEALED

VERDICT

Verdict Issuance

All three sub-gates passed, release sealed before publication.

✓ RELEASE_SEALED

PASS

RECEIPT SEALED

Checked before publication, not reconstructed afterward

Sub-gates

Signatures

10 J.

Retention

🧪

Trial Sponsor, Trial Event

CONSENT · PROTOCOL ADHERENCE · AE-NEVER-BLOCK

gateClinicalTrials ICH E6(R3) 21 CFR Part 11

EXAMPLE SCENARIO

Late AE report, still fully captured

A fictional trial site reports an adverse event twelve hours after the reporting deadline. Consent documentation and protocol adherence are complete. The report itself is not discarded, only documented as late.

CONSENT

Consent Documentation

All three signature hashes per subject valid, trial pool validity confirmed.

COMPLETE

PROTOCOL

Protocol Adherence

Administration timing fell within the master protocol window.

AE REPORT

AE Reporting

Report filed 12 hours after deadline, fully captured, not discarded.

passed: true

VERDICT

Verdict Issuance

AE_REPORTED_LATE, receipt status degraded, never blocked.

AE_REPORTED_LATE

DEGRADED

RECEIPT SEALED, STATUS DEGRADED

The report itself is never jeopardised, only its timeliness

Sub-gates

12h

Delay

15 J.

Retention

🚛

Carrier, Dangerous Goods Shipment

ADR · CSDDD/LKSG · CBAM

gateLogistics ADR 1.1.3.6 CBAM 2023/956

EXAMPLE SCENARIO

Dangerous goods within free limit, CBAM not yet due

A fictional carrier declares 2,000 kg of ADR class 3, within the 5,000 kg free limit, with complete supply chain documentation. A separate 2026 CBAM import has no certificate yet, but the purchase window has not yet opened.

HAZMAT

Dangerous Goods (ADR)

2,000 kg class 3, within the 5,000 kg free limit.

WITHIN LIMIT

SUPPLY CHAIN

Supply Chain (LkSG/CSDDD)

Supplier signatures complete, attestation present.

DOCUMENTED

CBAM

Certificate not yet on file, purchase window only opens 1 Feb 2027.

PENDING_NOT_YET_DUE

VERDICT

Verdict Issuance

All three gates correctly qualified, transport sealed.

✓ TRANSPORT_SEALED

PASS

RECEIPT SEALED

Free limits fixed in code, no external drift risk

Frameworks

2.000/5.000

kg ADR

10 J.

Retention

🌾

Importer, Food Batch

EUDR · EFSA · HACCP · TRACES-NT

gateAgriFoodComplianceEUDR

EXAMPLE SCENARIO

Fully checked coffee batch

A fictional importer submits a batch with a valid geo-polygon, cut-off before 2020, clean residue values, and an unbroken cold chain.

EUDR

Deforestation-Freedom

Geo-polygon present, cut-off before 31 Dec 2020.

PASS

VERDICT

Verdict Issuance

All four gates passed.

✓ AGRI_FOOD_SEALED

PASS

RECEIPT SEALED

Gates

10 J.

Retention

⚡

Grid Operator, RFNBO Delivery

RED III · BSI-SMGW · EU-ETS · NIS2

gateEnergyGridComplianceTR-03109

EXAMPLE SCENARIO

Fully checked hydrogen delivery

A fictional producer demonstrates hourly RFNBO matching and a valid smart meter certificate.

RED III

Hourly Matching

RFNBO generation and consumption correlated hourly.

PASS

VERDICT

Verdict Issuance

All four gates passed.

✓ ENERGY_SEALED

PASS

RECEIPT SEALED

Gates

10 J.

Retention

🚆

Railway Undertaking, Freight Run

TSI/RINF · RID/GGVSEB · ETCS-CCS

gateRailLogisticsRL 2016/797

EXAMPLE SCENARIO

Fully checked freight run

A fictional railway undertaking demonstrates valid TSI authorisation and RINF registration.

TSI/RINF

Vehicle Authorisation

TSI number and RINF line ID present.

PASS

VERDICT

Verdict Issuance

All four gates passed.

✓ RAIL_SEALED

PASS

RECEIPT SEALED

Gates

10 J.

Retention

🏗️

Industrial Operator, Plant Review

CBAM · IED/BAT-AEL · Seveso III · CSRD

gateHeavyIndustryVO (EU) 2023/956

EXAMPLE SCENARIO

Fully checked steelworks report

A fictional steelworks demonstrates sufficient CBAM certificates and emission values within the BAT-AEL range.

CBAM

Certificate Coverage

Sufficient CBAM certificates for imported goods.

PASS

VERDICT

Verdict Issuance

All four gates passed.

✓ INDUSTRY_SEALED

PASS

RECEIPT SEALED

Gates

10 J.

Retention

🏭

Warehouse Operator, AGV Fleet

Machinery Regulation · DGUV · IEC 62443

gateIntralogisticsDGUV 68

EXAMPLE SCENARIO

Fully checked distribution centre

A fictional operator demonstrates CE conformity of the AGV fleet and valid DGUV inspection intervals.

MASCHINE

Machine Safety

CE conformity and risk assessment present.

PASS

VERDICT

Verdict Issuance

All four gates passed.

✓ INTRALOGISTICS_SEALED

PASS

RECEIPT SEALED

Gates

10 J.

Retention

🧵

Procurement, Supplier Attestation

ESRS S2 · ILO CORE CONVENTIONS · BSCI · PER-SUPPLIER

gateEsgSocial ESRS S2 amfori BSCI

EXAMPLE SCENARIO

Complete attestation from a supplier

A fictional supplier attests to a buyer that all eight ILO core conventions are complied with, BSCI tier B, minimum wage met, 44 weekly hours, with a valid ECDSA-P256 signature.

ILO

ILO Core Conventions

All eight booleans, C029 through C182, attested as complied with.

8/8 TRUE

BSCI

BSCI Audit Tier

Tier B, satisfies the A-to-C requirement.

TIER B

SIGNATURE

Supplier Signature

ECDSA-P256 signature checked against the canonical attestation serialisation.

VALID

VERDICT

Verdict Issuance

All five checkpoints passed, attestation sealed.

✓ ESG_SOCIAL_SEALED

PASS

RECEIPT SEALED

Micro-attestation, separate from the corporate aggregate report

Checkpoints

ILO conventions

10 J.

Retention

🌍

Corporation, Sustainability Report

CSRD 2022/2464 · ESRS 2023/2772 · E+S+G

gateSustainabilityCompliance ESRS Audit-Provenienz

EXAMPLE SCENARIO

Complete annual report, all three pillars satisfied

A fictional corporation submits its 2025 report, Scope 3 disclosed, SBTi validated, no PFAS, 75 percent recycling, living wage 72 percent, anti-corruption policy signed, with limited assurance.

ENVIRONMENT

Environment Pillar

Scope 3 disclosed, SBTi validated, no PFAS, recycling above 65 percent.

4/4 PASS

SOCIAL

Social Pillar

Living wage above 50 percent, ILO conventions met, no child or forced labour.

PASS

GOVERNANCE

Governance Pillar

Anti-corruption policy signed, supplier code above 50 percent, SME payment duration under 60 days.

PASS

VERDICT

Verdict Issuance

All three pillars passed, audit provenance complete, report sealed.

✓ SUSTAINABILITY_SEALED

PASS

RECEIPT SEALED

Emissions factor dataset forensically anchored, reconstructible for ten years

Pillars

ESRS standards

10 J.

Retention

☁️

Cloud Providers & Hyperscalers

AWS · AZURE · GOOGLE CLOUD · TECHNICAL CLOUD ACT SHIELDING · STRENGTHENED DATA SOVEREIGNTY

Cloud Act Shielding TEE Sovereign Air-Gap

THE FUNDAMENTAL PROBLEM

CLOUD Act vs. GDPR — the Achilles heel of every cloud

Every US-based cloud provider — AWS, Azure, Google Cloud — is subject to the US CLOUD Act. US authorities can compel these companies via court order to hand over customer data, even if that data physically resides in European data centers. The EDPB has repeatedly confirmed: CLOUD Act compliance can constitute a GDPR violation. The dilemma: institutions need cloud infrastructure. But cloud infrastructure means potential US jurisdiction. immo.quick Core addresses this dilemma with technical controls: the provider can only produce what it technically has access to. This does not eliminate the legal process or every conceivable disclosure obligation.

TEE ENCLAVE

Trusted Execution Environment — physical isolation

All computations run in AWS Nitro Enclaves (Frankfurt), Intel SGX (Munich) or Azure Confidential Computing (Amsterdam). The enclave operator — AWS itself — has no access to plaintext data. Physical fact, not a promise.

ISOLATED

PCR0 ATTEST

PCR0 Hardware Attestation — tamper-proof

Every TEE instance generates a PCR0 attestation — the cryptographic fingerprint of the exact running code. If PCR0 changes without planned deployment: immediate critical alert. Manipulation is immediately visible.

PCR0 VALID

CLOUD ACT

Technical Cloud Act Shielding

US authorities can compel AWS to a lawful disclosure order. AWS, however, has no access to plaintext data in the enclave. A compelled disclosure would yield ciphertext, not intelligible customer data. A technical attestation document is issued: QES-signed, RFC-3161, EDPB Schrems II framework. Not a claim of legal immunity, a technical property of the architecture.

SHIELDED

SOVEREIGNTY

Strengthened data sovereignty, three layers

Layer 1: physical isolation (TEE). Layer 2: cryptographic separation (ML-KEM-768, keys never leave the TEE). Layer 3: technical attestation documentation (EDPB compliance, Schrems II framework). All three layers work together, without claiming legal immunity.

SOVEREIGN

AIR-GAP

Air-Gap Option — completely without US cloud

For institutions that also reject TEE-based cloud: full air-gap operation. No external network. No US provider. All rule sets local. Operable in national or private data centers. For governments, military, critical infrastructure.

AIR-GAPPED

SOVEREIGN

CLOUD ACT SHIELDING · TECHNICALLY GROUNDED · NOT JUST PROMISED

AWS · Azure · Google Cloud — usable with technical controls designed to reduce provider-access exposure

US data access possible

Sovereignty layers

Air-Gap

Option available

Shielded

CLOUD Act / FISA / NSL

Physisch

Not just contractual

EDPB

Schrems II compliant

TECHNICAL CONTROLS DESIGNED TO STRENGTHEN DATA SOVEREIGNTY

🔒

AWS Nitro Enclaves

Isolated processor core with dedicated memory. AWS has no network access, no SSH, no console access to the enclave. Attestation document signed directly by Intel chip. Not bypassable.

🔬

Intel SGX

Software Guard Extensions — physically isolated memory at CPU level. Even the operating system and hypervisor have no access. Intelligence access to plaintext data: physically impossible.

🏗️

Azure Confidential

Azure Confidential Computing with AMD SEV-SNP. Memory encryption at hardware level. Even Microsoft employees have no access to enclave plaintext data. A compelled disclosure would yield ciphertext, not intelligible data.

The difference: other providers promise data sovereignty contractually. immo.quick Core additionally strengthens it through hardware-level technical isolation, as a complementary, not a replacing, control.

How immo.quick handles each institution individually.

Regulation is moving toward execution.

Your institution not listed?

Compliance after execution is too late.

Observation. Prediction. Intervention. Authorization.