llmaudit.eu

LLM security audit · European Union

Scope an audit

Privacy policy

Updated

Operator and scope

llmaudit.eu is a free reference site operated by SEQ SIA (OffSeq), registration number 40203410806, Lastādijas iela 12 k-3, Riga, LV-1050, Latvia. The site has no user accounts, no newsletter and no comments. We receive personal data from the site only when you send it through the inquiry form. This notice covers the site itself; the linked OffSeq services have their own notice.

The interactive bench

Both tools on the home page, the LLM threat model and the AI Act obligation finder, run entirely in your browser. Your selections are held in page memory only: they are not transmitted to us, not written to local storage, not added to any outbound link and not included in any analytics event. Reloading the page discards them. Neither tool inspects your systems, your accounts or your infrastructure, and neither one is legal advice.

Inquiry form

Only the email address is required. If you provide them, we also receive your name, the topic you choose and your message. With them we receive the address of the page and the form placement the request was sent from, the time it was sent and the country Cloudflare derives from the connection. Your IP address is not included in the message or stored; Cloudflare uses it briefly to limit the number of submissions and deter automated spam. Your bench selections are not attached to the request.

To tell people apart from automated spam, the form uses Cloudflare Turnstile. It loads only once you start filling in or submit the form and assesses technical browser and connection signals, such as the IP address and browser user agent; we do not pass what you type into the form to it. Cloudflare performs this check as our processor and also uses the signals, as an independent controller, to improve its bot detection (Turnstile Privacy Addendum). Our server receives only the result of the check and does not store it. To catch mistyped addresses, after you submit, our server looks up the email domain (the part after @) in Cloudflare’s public DNS; only the domain is sent. The legal basis is our legitimate interest in protecting the form from abuse (Article 6(1)(f) GDPR).

We use these data only to answer your request and, if you ask for one, to prepare a service proposal. The legal basis is steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and, for questions unrelated to a service, the controller’s legitimate interest in answering correspondence it receives (Article 6(1)(f) GDPR). Providing the data is voluntary; without an email address we cannot reply.

Cloudflare’s email service, acting as a processor, delivers the request as an email to SEQ SIA’s mailbox, where the SEQ SIA staff who answer inquiries receive and handle it. We keep requests for up to 12 months after our last contact with you; if we enter into a contract, correspondence is kept for as long as the contract and applicable law require. Analytics records only a “Lead Submitted” event with the form placement – none of the details you enter.

Technical requests and traffic measurement

Serving a page through Cloudflare involves technical request data, including an IP address, browser headers, the requested URL and the request time. These data support delivery, security and operation of the site.

The site sends page views, clicks on OffSeq service and contact links and successful inquiry-form submissions to our self-hosted, Plausible-compatible analytics service at in.ainalytic.net. An event contains the site domain, the public page address, a limited set of campaign parameters, and the origin of the referring site when the browser supplies one. A link-click event adds the destination path and a static placement label such as header, hero or footer; a “Lead Submitted” event adds only the form placement. Tool selections, results and form fields are never included. The application sets no analytics cookie and no persistent visitor identifier; the collector receives the technical network information that accompanies any request. Cookieless measurement is still processing of data.

Measurement is switched off when the browser signals Do Not Track or Global Privacy Control, when the local-storage value plausible_ignore is true, and for previews, local development and recognized automation. OffSeq links carry static referral labels identifying this site and the position of the link; those labels never contain anything you selected or typed.

Technical request data are used to operate and secure the site. Page-view, link-click and form-submission statistics are used to understand which references are read and which OffSeq services readers are interested in. The stated legal basis for both is legitimate interests under Article 6(1)(f) GDPR. Hosting and infrastructure providers process requests on our behalf; the analytics service is self-hosted. Data are kept only as long as needed for those purposes and any applicable legal obligation. The operator privacy policy sets out its retention criteria, processors and transfer safeguards.

If you write to support@offseq.com we handle your correspondence in the same way as inquiry-form requests. Links to OffSeq, to EUR-Lex, to OWASP, to MITRE and to the incident write-ups cited on this site lead to services with their own privacy notices.

Your rights

Subject to the conditions in the GDPR you may request access, rectification, erasure, restriction or portability, and you may object to processing based on legitimate interests. Write to support@offseq.com. You may also lodge a complaint with the Data State Inspectorate of Latvia (Datu valsts inspekcija) or with the supervisory authority where you live or work. The cookie and browser-storage notice lists everything this site can store on your device.