Soma1. Agree the deployment boundary
SomaHQ can be scoped as EU private cloud, on-premises or hybrid. EUTS’s responsibilities depend on the services it actually operates. Before rollout, complete the matrix below with named owners, access, escalation and acceptance evidence. This schedule becomes contractual when incorporated into the order; it is not evidence that every control is already enabled.
2. Responsibility matrix
| Area | EUTS | Customer |
|---|---|---|
| Infrastructure | Operate and patch hosting, networks and backups included in the managed scope. | Operate on-premises infrastructure and retained systems unless managed by EUTS; secure user devices and networks. |
| Application | Deliver agreed software, patches and deployment documentation. | Approve configuration, user acceptance and change windows; maintain customer-managed extensions. |
| Identity and access | Provide agreed access controls; restrict EUTS support access. | Approve roles, joiner/leaver processes, identity-provider settings and key ownership. |
| Personal data | Meet processor duties, TOMs, provider restrictions and assistance obligations. | Determine lawful purposes and legal bases; provide notices and assess rights, retention and DPIAs as controller. |
| AI and integrations | Disclose and implement the approved model and data flow; keep actions within permissions. | Approve connections, intended uses and meaningful review; maintain the legal basis for imported data. |
| Incidents | Investigate within managed scope and notify without undue delay under the DPA. | Provide an incident contact, handle controller notifications and report suspected misuse. |
| Availability and exit | Meet agreed recovery, export and deletion duties. | Define business continuity, validate exports and revoke remaining third-party connections. |
3. Shared duties and legal responsibilities
A customer setting does not excuse an EUTS security defect; an EUTS control does not supply a customer’s lawful basis. Both parties must cooperate on faults crossing the boundary. On-premises deployments must document remote access, support copies and external AI or email services. “Self-hosted” does not mean that no data can leave customer infrastructure.
Use this matrix alongside the DPA, TOMs, SLA and AI terms. Legal duties remain with the party to which the law assigns them.
SomaHQ · EUTS UG (haftungsbeschränkt)
contact@euts.ai · Legal hub