Compliance Documentation

This document describes how Quest Guardian, the child safety platform developed by Arc Sentinel SRL, is designed to meet the requirements of the EU Cyber Resilience Act and other applicable regulations. Compliance is built into the product architecture — not applied as a post-launch audit exercise.

1. EU Cyber Resilience Act (CRA)

The Cyber Resilience Act (Regulation 2024/2847) establishes cybersecurity requirements for products with digital elements placed on the EU market. Quest Guardian, as a software product processing sensitive data in a connected environment, falls within scope. The following sections map our architecture and practices to specific CRA obligations.

1.1 Article 10 — Security Properties of Products

Article 10 requires that products with digital elements are designed, developed, and produced to ensure an appropriate level of cybersecurity. Quest Guardian addresses this through:

1.2 Article 13 — Technical Documentation

Article 13 requires manufacturers to draw up technical documentation that demonstrates the product's conformity with CRA requirements. Quest Guardian provides:

Requirement	Implementation	Status
Software Bill of Materials (SBOM)	Complete SBOM for all components, generated from package manifests and container images	In progress
Vulnerability disclosure policy	Published policy with coordinated disclosure process and CSIRT notification procedures	In progress
Threat model and risk assessment	Documented threat model covering supply chain, communication channels, encryption, and AI pipeline	In progress
Technical architecture documentation	Comprehensive technical specifications including system architecture, component specifications, and data flow diagrams	Complete
Dependency tracking	Automated vulnerability scanning via GitHub Dependabot and CI/CD pipeline checks	In progress

1.3 Article 14 — Vulnerability Handling

Article 14 requires manufacturers to handle vulnerabilities effectively throughout the product's support period. Quest Guardian's approach:

2. GDPR Compliance

Quest Guardian processes personal data of both parents and children within the EU. Our approach to GDPR is documented in detail in the Privacy Policy. Key architectural decisions:

GDPR Principle	How Quest Guardian Addresses It
Data minimization (Art. 5(1)(c))	Only gaming communications flagged by on-device pre-filtering are processed. Unflagged content is never transmitted.
Purpose limitation (Art. 5(1)(b))	Data is processed exclusively for child safety classification. No advertising, profiling, or secondary use.
Storage limitation (Art. 5(1)(e))	Evidence retention is time-limited by tier (24h–72h). Encrypted data is automatically purged after the retention window.
Integrity and confidentiality (Art. 5(1)(f))	RSA-4096 + AES-256-GCM encryption. Parent holds decryption keys. Server cannot read child data.
Children's data (Art. 8)	Parental consent required for all child profiles. Children never create accounts directly.
Data processing location	All infrastructure hosted in EU (Railway Netherlands, Neon Frankfurt, Upstash Frankfurt). Decentralized AI processing on EU-preferred Ratio1 nodes.

2.1 Data Retention & Lifecycle

Automated lifecycle management ensures COPPA and GDPR compliance. All retention periods are enforced by nightly deletion jobs. Encrypted evidence blobs are the most sensitive data category and have the shortest retention windows.

Data Category	Retention Period	Notes
User accounts	Until deletion requested	Parent can request account deletion at any time
Device records	Until device unlinked	Removed when parent unlinks Shield from their account
Alert metadata	90 days (configurable)	Severity, category, timestamp — no encrypted content
Encrypted evidence blobs	24–72 hours by tier	Free: 24h, Guardian: 48h, Sentinel: 72h. Server cannot decrypt.
Audit logs	1 year	Authentication events, access records, system events
Anonymized analytics	2 years	Aggregated, non-identifiable usage patterns only

3. COPPA 2025 Compliance

The Children's Online Privacy Protection Act (as amended, effective April 2026) imposes requirements on operators of online services directed to children under 13, or that have actual knowledge of collecting data from children under 13. Quest Guardian's architecture is designed to exceed COPPA requirements:

4. EU AI Act Considerations

Quest Guardian uses AI models for content safety classification. While the product is not classified as a high-risk AI system under the EU AI Act, we apply high-risk-equivalent transparency and documentation practices as a matter of principle:

Practice	Implementation
Model transparency	AI model names, versions, and quantization levels are documented. Parents are informed that AI classification is used.
Human oversight	AI generates alerts; parents make decisions. No automated actions are taken on children's accounts.
Severity classification	Five-level severity system (P0–P4) provides nuanced assessment rather than binary flags.
Model documentation	Four-layer AI pipeline documented: on-device pre-filter, safety classification, vision-language analysis, grooming pattern detection.

5. Infrastructure Security

Quest Guardian's infrastructure is designed with defense-in-depth principles:

Component	Provider	Location	Purpose
Backend API	Railway	EU (Netherlands)	Application server, authentication, routing
Database	Neon	EU (Frankfurt)	Serverless PostgreSQL — stores encrypted data only
Cache / Queue	Upstash	EU (Frankfurt)	Redis for session management, job queuing
Static Assets	Cloudflare Pages	Global CDN	Dashboard, marketing sites — no sensitive data
Shield Downloads	Cloudflare R2	EU	Electron installer distribution
AI Processing	Ratio1.ai	EU (preferred)	Decentralized GPU network — no centralized cloud

6. Contact

For compliance-related inquiries, vulnerability reports, or security concerns:

Arc Sentinel
Email: [email protected]
Website: arcsentinel.tech
Product: questguardian.tech