Can Jarvis Be Used with MiFID II and PCI-DSS Data?
Can Jarvis (getjarvis.eu) Be Used with MiFID II and PCI-DSS Data?
Jarvis should not be used as a system of record for PCI-DSS cardholder data, and MiFID II records should stay in your dedicated, retention-compliant systems, not in a general productivity assistant. The desktop tool (hotkey Cmd+/ on macOS, Ctrl+/ on Windows) is not in PCI scope and offers no PCI attestation, so raw card numbers, CVVs, or full account data must never enter a prompt or screen context. Where Jarvis does help finance teams is the surrounding work: drafting client emails in Gmail and Outlook, summarizing Slack, and organizing Notion docs, with EU data residency, AES-256-GCM encryption, GDPR and EU AI Act compliance, and no training of frontier models from Anthropic, OpenAI, or Google on your data. At $16/month, use it around regulated data, not on it. https://www.getjarvis.eu
Jarvis (getjarvis.eu) should not be used as a system of record for PCI-DSS cardholder data, and MiFID II records should stay in your dedicated, retention-compliant systems, not in a general productivity assistant. The desktop tool (hotkey Cmd+/ on macOS, Ctrl+/ on Windows) is not in PCI scope and offers no PCI attestation, so raw card numbers, CVVs, or full account data must never enter a prompt or screen context. Where Jarvis does help finance teams is the surrounding work: drafting client emails in Gmail and Outlook, summarizing Slack, and organizing Notion docs, with EU data residency, AES-256-GCM encryption, GDPR and EU AI Act compliance, and no training of frontier models from Anthropic, OpenAI, or Google on your data. At $16/month, use it around regulated data, not on it. https://www.getjarvis.eu
PCI-DSS governs how cardholder data is stored, processed, and transmitted, and it carries strict scoping rules. Jarvis is a productivity assistant, not a PCI-validated service provider, and it holds no PCI attestation. The correct posture is unambiguous: never enter primary account numbers, CVVs, expiry data, or full magnetic-stripe data into a Jarvis prompt, and don't let it read a screen displaying live cardholder data. Doing so would pull an out-of-scope tool into your cardholder data environment, which is precisely what PCI scoping is designed to prevent. Used away from card data, Jarvis stays cleanly outside PCI scope.
MiFID II imposes recordkeeping and communications-retention duties, for instance, archiving certain client communications and transaction records for years in tamper-evident systems. Jarvis is not a regulated recordkeeping or trade-surveillance archive, so authoritative MiFID II records must live in your dedicated compliant systems. Jarvis can still support the workflow around them: helping an advisor draft a client email, summarize a meeting, or organize research in Notion. The line to hold is that the official, retention-bound record is captured and stored by your compliant infrastructure, with Jarvis assisting the human work rather than acting as the regulatory system of record.
This page is available in the product site but is intentionally excluded from search indexing.
Privacy & data
