EXPERT CHECKLIST / 15 CHECKS

The honest self-check for teams working with sensitive dossiers.

Fifteen checks across three domains: does your data stay in Europe, do you find what is spread out, and can you defend every piece of advice with an exact source? Tick what applies to you — you get a concrete way to fix each point yourself, and see exactly where Kervalt takes the work off your plate.

Anonymous — your answers never leave your browser. No email address required.

Your score

0 / 15 points of attention

01 / Data sovereignty

Does your data pass through non-EU services unnoticed? Who can access it, who keeps what, and who trains on it?

We have a complete list of every tool employees upload company documents to.

HOW TO CHECK THIS

Ask each team (legal, finance, operations) which tools they use for documents and compare with the SSO and expense lists. Anything nobody reported is shadow IT.

HOW TO FIX THIS YOURSELF

Set up one central inventory and make IT approval mandatory before any new tool may process documents.

WITH KERVALT

runs entirely within a single EU environment on its own bare-metal infrastructure — no external AI service ever touches your data.

For every vendor we know in which regions our data is processed and how long it is kept after deletion.

HOW TO CHECK THIS

Request the data processing agreement (DPA) and subprocessor list from each vendor and search for 'data residency', 'retention' and 'deletion'. Verbal assurances do not count.

HOW TO FIX THIS YOURSELF

Get written confirmation of region and deletion terms, or migrate to an EU region. Record everything in your processing register.

WITH KERVALT

is hosted in the EU-WEST-1 region; deletion is definitive and contractually guaranteed.

No vendor or subprocessor falls under U.S. jurisdiction (CLOUD Act).

HOW TO CHECK THIS

Check the parent company of each subprocessor: a U.S. parent must hand data to the U.S. government, even when it is stored in Europe.

HOW TO FIX THIS YOURSELF

Replace U.S. subprocessors with EU-owned alternatives (e.g. European hosting for compute and storage).

WITH KERVALT

runs on European bare metal at European providers, beyond the reach of the U.S. CLOUD Act.

Our AI tools do not train on our documents — excluded contractually and technically.

HOW TO CHECK THIS

Search the terms for 'model improvement', 'training' and 'opt-out', and verify enterprise settings are actually enforced.

HOW TO FIX THIS YOURSELF

Explicitly enable the opt-out or take a tier with guaranteed data isolation; get written confirmation annually.

WITH KERVALT

never trains on customer data — a local AI model, no exchange with public models.

We manage the encryption keys of our most sensitive dossiers ourselves.

HOW TO CHECK THIS

Ask who manages the encryption keys and whether the vendor can read your data in plain text. 'Encrypted' without your own keys is not control.

HOW TO FIX THIS YOURSELF

Request CMEK or BYOK options from your vendor, or keep the most sensitive dossiers fully on-premise.

WITH KERVALT

offers customer-managed keys (CMEK) and air-gapped deployments: you quite literally hold the keys.

02 / Connections across documents

Standard searches miss risks that spread across documents and systems. Test your visibility.

In a single query we find every mention of an entity — person, company or clause — including aliases and subsidiaries.

HOW TO CHECK THIS

Pick one entity from an active dossier and time how long it takes to find all mentions across all systems, including name variants and other languages.

HOW TO FIX THIS YOURSELF

Build your own index with synonym and alias lists per domain — or accept that blind spots exist.

WITH KERVALT

automatically captures entities and their relationships across all your documents; one question suffices.

During every contract review we immediately see the linked obligations in other documents.

HOW TO CHECK THIS

Take an amendment or termination clause and manually search which other contracts change along with it. Time how long that takes.

HOW TO FIX THIS YOURSELF

Keep a manual cross-reference register — labour-intensive and outdated the moment anything changes.

WITH KERVALT

follows multi-hop dependencies (e.g. cross-defaults across five folders) automatically and shows the chain reaction.

We can reconstruct ownership or group structures directly from our own documents.

HOW TO CHECK THIS

Ask an analyst to build the structure of a target company using only your own files — no external sources.

HOW TO FIX THIS YOURSELF

Record structures centrally in an entity-management tool with manual maintenance and named owners.

WITH KERVALT

automatically computes ownership trees and reporting lines from your contracts and deeds.

Different systems hold no conflicting versions of the same facts (amounts, dates, names).

HOW TO CHECK THIS

Pick five core facts from an active dossier and compare them across contracts, spreadsheets and email. Log every conflict and who must resolve it.

HOW TO FIX THIS YOURSELF

Assign each core figure one 'system of record' and document which system is leading.

WITH KERVALT

checks hard facts (Elimu) deterministically against the source data and flags conflicts immediately.

Our search finds content even when different words or another language are used.

HOW TO CHECK THIS

Search for one concept with synonyms and in a second language; count what your current search misses.

HOW TO FIX THIS YOURSELF

Build a controlled thesaurus per domain and train staff in search terms — but acknowledge the limits of keywords.

WITH KERVALT

understands meaning and context (Tafari): you ask in plain language, the language of the document does not matter.

03 / Citations and verification

People waste hours checking and keep worrying about hallucinated references. Measure what it costs you.

Every answer from our AI links with one click to the exact source passage.

HOW TO CHECK THIS

Take the last ten AI answers from your team and count how many sources you had to look up manually before trusting them.

HOW TO FIX THIS YOURSELF

Mandate a source citation with every answer in your prompts and enforce it with spot checks.

WITH KERVALT

provides every answer with a bidirectional citation: one click to the exact sentence, row or graph node.

From any source passage we can see which conclusions and advice were based on it.

HOW TO CHECK THIS

Pick one document paragraph and try to find out which pieces of advice or reports came out of it.

HOW TO FIX THIS YOURSELF

Keep a manual log of prompt, answer and source — requires discipline from every team member.

WITH KERVALT

links every output to its sources in both directions, making audit and traceability trivial.

We measure how many hours per week the team spends verifying AI output.

HOW TO CHECK THIS

Have three team members track the time they spend verifying AI answers for one week. The result almost always surprises.

HOW TO FIX THIS YOURSELF

Set a hard rule: output that cannot be verified within fifteen minutes is not used.

WITH KERVALT

reduces the verification burden with sentence-level citations — checking becomes a click, not a search.

Six months later we can still show which answer the system gave, based on which document version.

HOW TO CHECK THIS

Find your team's oldest AI answer, including the version of the source that was valid at the time. Can you do it within ten minutes?

HOW TO FIX THIS YOURSELF

Version your source files and archive prompts and answers immutably with timestamps.

WITH KERVALT

versions sources and stores every answer linked to the exact document version — audit-ready.

Figures and dates from tables are automatically verified against the source data — not retyped.

HOW TO CHECK THIS

Take five figures from recent pieces of advice and verify each one against the original tables and databases.

HOW TO FIX THIS YOURSELF

Connect reports with formulas directly to source data instead of retyping values.

WITH KERVALT

checks dates, amounts and thresholds exactly against the relational source (Elimu) — no rounding or typos.

THE DECISION

Fix it yourself, or Kervalt?

Every check above can honestly be solved in-house — with processes, registers and discipline. The question is not whether it can be done, but what it costs and who holds the line.

Fix it yourself

Weeks to months per domain, plus ongoing maintenance of registers, thesauri and logbooks.
Quality stays dependent on human discipline — with staff turnover or peak pressure, the control disappears.
Every new dossier or system means the work starts over.

The best choice when your dossiers are small, stable and not sensitive.

With Kervalt

Deployment in days; all fifteen checks are built in by default, no project required.
Sentence-level citations, multi-hop insight and deterministic fact-checking out of the box.
100% EU bare metal, CMEK and air-gapped options — audit-ready without extra registers.
Fixed pricing: €1,995 implementation, then €299 per seat per month.

The best choice when your dossiers are sensitive, spread out and under time pressure.

We do not sell fear: with a solid baseline you do not need Kervalt. Most teams, however, score medium or high — and usually only find out why after an incident.

NEXT STEP

See every check covered live, in your own kind of dossier.

In a free 30-minute demo we walk through this checklist with a dossier of your choice. You see the citations, the connections and the EU infrastructure — no slideware.

Book a free demo Take the assessment first