AI Partner

Trust centre

Security and privacy at AI Partner.

We build for procurement teams. This page is the public mirror of our internal security playbook — refreshed in lockstep with the product.

Data residency

Production data is stored in EU (Frankfurt) for EU tenants and US (Iowa) for US tenants. Region is set at company creation; we never replicate across boundaries without explicit consent.

Encryption in transit

TLS 1.3 everywhere. HSTS preload enforced on the apex domain. Webhook deliveries reject HTTP and any redirect.

Encryption at rest

Database volumes are encrypted with AES-256 (provider-managed keys). Application-level AES-256-GCM wraps secrets we have to store but never re-display (TOTP, SCIM, webhook secrets).

Audit trail

Every state-changing action emits an immutable audit row with the actor, payload (redacted), IP hash, and trace id. Logs are retained for 365 days; tenants can export their slice via the public API.

Access control

Workforce SSO via Google Workspace, MFA mandatory. Application RBAC enforced per-action with row-level conditions; least-privilege defaults for every role.

Vendor management

Every sub-processor is contractually bound to GDPR Art. 28 obligations. New additions require a DPA addendum and 30-day notice.

Sub-processors

Vendors that process customer data on our behalf. The full disclosure — including processing activity, location and change notice — lives on the sub-processors page. Machine-readable JSON is available at /api/v1/sub-processors.

  • Google Cloud Platform (Google Ireland Limited)

    Application hosting (Cloud Run), managed PostgreSQL (Cloud SQL), encrypted object storage for brief attachments (Cloud Storage), secret management, and container builds. Processes all customer and partner data at rest.

    Location
    European Union (Belgium)
    Certifications
    ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, SOC 1, SOC 2, SOC 3
    Since
    2026-08-25

  • Google Workspace (Google Ireland Limited)

    Transactional email delivery over SMTP: notifications, workspace invitations, email verification and password resets. Processes recipient name, email address and message contents.

    Location
    European Union
    Certifications
    ISO/IEC 27001, ISO/IEC 27701, SOC 2, SOC 3
    Since
    2026-08-25

  • Google Calendar & Google Meet (Google Ireland Limited)

    Scheduling scoping calls and hosting the video meeting. Processes attendee email addresses, meeting titles and agendas, and free/busy availability of the AI Partner host calendar.

    Location
    European Union
    Certifications
    ISO/IEC 27001, ISO/IEC 27701, SOC 2, SOC 3
    Since
    2026-08-25

  • Groq, Inc.

    Large language model inference that drafts structured briefs from customer answers, extracts briefs from call transcripts, extracts partner profiles from public pages, and anonymises partner proposals before comparison. Processes brief content, uploaded document text and call transcripts. Inference inputs and outputs are not retained by default; where retained for reliability or abuse investigation the period is up to 30 days. Processed in the United States under Standard Contractual Clauses.

    Location
    United States
    Certifications
    SOC 2
    Since
    2026-08-31

Cookie policy

We use three categories of cookies:

  • Necessary — required for authentication, CSRF protection, language preference. Always on; can’t be disabled without breaking the product.
  • Analytics — anonymous product usage telemetry (PostHog). Off by default; opt-in via the banner.
  • Marketing — retargeting pixels. Off by default; opt-in via the banner.

Policy version 2026-05-01. You can change your choice anytime via the banner; clearing the cookie re-prompts you.

Security disclosures

Found a vulnerability? Email security@aipartner.example with a clear description, reproduction steps, and your contact details. We respond within one business day and credit reporters in our hall of fame on request.