Trust and deployment evidence
The systems behind Andes, and the evidence we have verified.
This page records the current deployment, provider locations and product boundaries behind Check, Kernal and Magellan.
Orders and schedules define customer-specific commitments. This page records the public operational baseline and the boundary of each product.
Scope register
Statements are kept separate by surface. A control or deployment fact listed for one product does not automatically apply to the others.
Public Check intake uses bounded fit-assessment fields. Applicants are asked not to submit system records, evidence files, credentials or personal data about other people.
Current public workflowCheck records an inventory and supports first-pass cited candidate categorisation. Named human review remains required before legal, assurance or compliance conclusions.
Product boundaryThe managed Kernal runtime is deployed on AWS in eu-west-1. Deployment, access, data handling and retention commitments are agreed in the applicable order and schedule.
Current deploymentKernal was installed in a separate AWS buyer account using a Marketplace entitlement. Authenticated use, record persistence through a service replacement and complete removal were verified on 10 August 2026.
End-to-end test completedMagellan produces cited intelligence material for customer review. It does not provide investment advice, assurance or disclosure decisions.
Product boundaryAWS deployment
Tested in a separate buyer account.
We installed Kernal, confirmed its Marketplace entitlement, used it behind authentication, replaced the running service without losing its records, then removed the deployment and its retained resources.
Providers and locations
Google Cloud / Firebase App Hosting runs the dedicated compliance backend in europe-west4. Google Cloud Firestore stores application and operational records in multi-region eur3.
App Hosting: europe-west4; Firestore: eur3Firebase Authentication is a US-only dependency for portal and operator authentication. Google Workspace handles email, calendar and restricted Drive artifacts under a verified Europe data-at-rest policy; support and transfer boundaries remain governed by Google's applicable terms.
No universal EEA-only processing claimAWS is the verified managed-runtime location for Kernal in eu-west-1. Any customer deployment or processor commitments are recorded in the relevant order.
Managed runtime: eu-west-1Retention and deletion terms differ by processing activity and product. They are not represented here as one universal period.
Product and order specificProduct boundaries
Check supports first-pass categorisation and does not provide legal advice or a compliance determination. Magellan prepares cited material for review and does not make investment or disclosure decisions. Kernal proposes records for human review; it does not accept them automatically.
Supporting documents
The current security statement, data-processing materials and product-specific documentation are available on request. Request them through explore@andes.no.
For a vulnerability report, factual correction or privacy request, use the routes on Support. See also Service terms and Privacy notice.