#NIS2 Supplier Statement

STM-EU-002 v1.0.0, Last Modified On 01 August 2026, Tier: Public

Written to be handed straight into a hospital's own supply-chain security file. Every row cites an artefact rather than an assurance.

---

#Applicability

---

#1. The boundary, stated first

Edsol Edtech Pvt. Ltd. is not an essential entity and not an important entity under Directive (EU) 2022/2555 or any national transposition of it. It is not established in the Union or the EEA for that purpose, it does not operate as a provider of a covered digital infrastructure or digital service in the Union, it holds no registration with any national competent authority under those instruments, and it does not represent that it does.

Its obligations in this statement are contractual. They flow from the hospital's own statutory position, not from Pensieve Labs's.

Stating this precisely is more useful to a hospital's own documentation than implying a registration that does not exist. It is the same discipline Pensieve Labs applies to national digital health credentials: the hospital is the regulated participant; Pensieve Labs operates inside the hospital's authority and says so.

---

#2. Why a supplier gets pulled in anyway

Article 21(2)(d) of the Directive requires a covered entity to address supply chain security, including security-related aspects concerning the relationships between the entity and its direct suppliers or service providers. Article 21(3) requires the entity to take into account the specific vulnerabilities of each direct supplier, the overall quality of their products and cyber-security practices, and their secure development procedures.

In practice a covered entity discharges that duty by flowing requirements into its supplier contracts. A subcontractor to a health entity is therefore reached indirectly, through supply-chain requirements, even though it operates no critical infrastructure of its own. That describes Pensieve Labs exactly.

Hospitals are ordinarily essential entities in the health sector. A regional or state hospital operator almost always is. A private hospital may be an essential or an important entity depending on size and on the national transposition, and Pensieve Labs does not tell a hospital which it is; the hospital's own registration position governs.

---

#3. Transposition status: stated accurately, because secondary sources are not

Pensieve Labs does not assert a transposition status it has not checked. The current position for the two EEA markets in scope is held in the country delta packs and summarised here:

[Both rows are verified at the date of a bid or a signature, not assumed from this document. The delta packs eu/dk/andeu/no/ carry the current position and the source.]

---

#4. The commitments, mapped to Article 21(2)

Each row states the commitment and names the artefact that evidences it. A hospital can cite the artefact in its own file.

---

#5. Supply chain: the commitment in detail

Article 21(2)(d) is the clause Pensieve Labs is being asked about, so it gets its own section.

5.1 The register is public. DIS-GL-009 names every sub-processor, its role, the country in which it processes, the categories of data it may reach, and the transfer safeguard relied on. DIS-GL-010 is the change feed and a hospital can subscribe to it. A hospital should not learn of a sub-processor's existence for the first time in a breach notification.

5.2 Flow-down. Each sub-processor is bound in writing to obligations no less protective than those Pensieve Labs owes the hospital, including incident notification, security measures, personnel obligations and the transfer safeguards.

5.3 Change notice and objection. Thirty days' notice of an addition or replacement of a sub-processor that processes hospital data, with a right to object on reasonable data-protection or security grounds and, if the objection cannot be accommodated, a right to terminate the affected services without liability for the period after termination. POL-GL-055.

5.4 Verification, not assurance. Pensieve Labs operates a documented programme for verifying that its sub-processors meet the flowed-down obligations, rather than merely contracting for them. For each sub-processor that processes hospital data the programme records, annually: the security documentation and any independent assessment examined; where the sub-processor processes outside the EEA, a recorded assessment of the transfer safeguard against the European Essential Guarantees; the date, the reviewer and the conclusion; and the action taken on a failure, up to replacement. The evidence is available to the hospital on request. POL-GL-135.

This is the item most vendors do not have, and it is the item European public bodies have been criticised for lacking in their own supply chains, specifically for not assessing transfers to sub-processors in third countries. Pensieve Labs is one of those third-country suppliers. The answer is a programme with dated evidence, not a paragraph.

5.5 Concentration and single points. The register states where a component has no ready substitute. Pensieve Labs does not claim a multi-cloud posture it does not have: the infrastructure provider is single-sourced, and DIS-GL-014 states what that means for continuity and what the exit path is.

5.6 Liability. Edsol Edtech Pvt. Ltd. remains fully liable to the hospital for its sub-processors' performance.

---

#6. Incident reporting: how Pensieve Labs's outputs feed the hospital's filings

DIS-EU-016 is the source of truth for the clocks and the notification content. MSA-EU-001 clause 5.2 makes them contractual.

Where an incident may be significant for more than one hospital, each affected hospital is notified; no hospital is told another's identity.

---

#7. Deployment-model boundary

A single undifferentiated security statement would be untrue in at least one model.

In DM-4 Pensieve Labs will not commit to detecting an incident on infrastructure it cannot observe. A hospital that wants the full commitment should forward telemetry or choose DM-1.

---

#8. Governance and accountability

Article 20 places responsibility for approving and overseeing risk-management measures on the covered entity's management body, and requires its members to follow training. That obligation is the hospital's and Pensieve Labs does not discharge it.

What Pensieve Labs does offer, so that the hospital's management body can discharge it:

1. a named security owner, recorded at Roadmap security owner, reachable at info@pensievelabs.org;
2. an annual written supply-chain assurance response, delivered within 10 Business Days of a written request, once per contract year without charge;
3. the audit right in ADD-GL-001, extending to verification of this statement; and
4. attendance at one governance or risk review per contract year at the hospital's request.

---

#9. What Pensieve Labs will sign, and what it will not

Being explicit here removes a negotiation round.

Will sign:

• the commitments in Section 4, Section 5 and Section 6, as drafted in MSA-EU-001 clause 5;
• an obligation to notify the hospital of a security incident within four hours of awareness;
• an obligation to cooperate with the hospital's competent authority and to supply information that authority requests of a supplier;
• a right of audit, and a right for the hospital's regulator to audit;
• an obligation to remedy a security deficiency at Pensieve Labs's own cost where the deficiency is a breach of the security addendum or of this statement;
• an obligation to renegotiate the flow-down text without charge if the national transposition changes.

Will not sign:

---

#10. Evidence pack: what a hospital receives on request

Delivered as one download, within 5 Business Days of a request, under the applicable tier gate.

---

#11. Limitations

11.1 This is not a certification. Edsol Edtech Pvt. Ltd. holds no ISO/IEC 27001 certificate, no SOC 2 report and no equivalent. The management system is mapped to ISO/IEC 27001:2022 Annex A and the statement of applicability is published without a certificate. WPR-GL-005 states what compensates.

11.2 Transposition varies. The Directive is transposed differently in each State, and a national act may impose requirements this statement does not anticipate. MSA-EU-001 clause 5.9 commits Pensieve Labs to renegotiate the flow-down without charge where that happens.

11.3 Registration status can change. If Edsol Edtech Pvt. Ltd. ever establishes in the Union or the EEA in a way that brings it into scope, this statement is revised and the hospitals affected are notified.

11.4 Sub-processor verification is documentary and, where offered, based on the sub-processor's own independent assessment. Pensieve Labs does not perform on-site audits of hyperscale infrastructure providers and does not claim to.

---

#12. Related documents

---

#13. Signature

---

#14. Change history