BidReview Trust Centre
You spend all day answering security questionnaires.
Here’s ours.
BidReview.ai runs on AWS infrastructure, keeps your bid data inside the UK and Ireland, and never lets a model learn from your content. Below is exactly how – claim by claim, with the technical detail behind each one.
Hosted on AWS Europe
Zero AI training on your data
Full audit trail, every action
How we protect your data
Enterprise Grade Encryption
Every byte of data is encrypted at rest and transit – no exceptions.
Encryption is enforced end to end using AWS-native key management – there’s no point between your browser and our storage layer where data sits unencrypted.
AT REST
Encryption keys managed and rotated automatically via AWS KMS.
Backups and snapshots inherit the same encryption by default.
IN TRANSIT
TLS 1.2+ enforced on every API and browser connection.
HSTS enabled to prevent downgrade to unencrypted HTTP.
Certificate lifecycle managed via AWS Certificate Manager.
KEY MANAGEMENT
Keys held in AWS KMS, never embedded in application code.
Access to keys restricted by least-privilege IAM policy.
All key usage logged for audit via CloudTrail.
EU Data Residency
Your data stays in Frankfurt, an EU AWS regions – it never leaves our borders.
We host in AWS’s Frankfurt region, so storage and processing happen on infrastructure physically located in Ireland – satisfying both UK GDPR and EU GDPR data localisation expectations without a separate compliance project.
REGULATORY FIT
Aligned to UK GDPR for UK-based customer data.
Aligned to EU GDPR for Ireland/EU-based customer data.
No reliance on cross-border transfer mechanisms (SCCs) for in-region processing.
IN TRANSIT
TLS 1.2+ enforced on every API and browser connection.
HSTS enabled to prevent downgrade to unencrypted HTTP.
Certificate lifecycle managed via AWS Certificate Manager.
Certified Infrastructure
We build on AWS infrastructure independently certified to the standards your procurement team already trusts.
Under the AWS shared-responsibility model, AWS secures and certifies the physical infrastructure, networking, and host layers – and we build BidReview.ai directly on top of that certified foundation, inheriting its assurance while we focus on securing the application layer ourselves.
INHERITED FROM AWS
ISO 27001, 27017 (cloud security) and 27018 (cloud privacy).
SOC 1, SOC 2, and SOC 3 reports covering the underlying infrastructure.
CSA STAR and PCI DSS Level 1 certified data centres.
BIDREVIEW LAYER
Application-level access control, identity, and configuration.
Secure software development practices for our own codebase.
A first independent penetration test is on our near-term roadmap.
Isolated, Locked-down Network
Your data sits in a private network boundary – never directly reachable from the public internet.
Storage and processing run inside a private AWS Virtual Private Cloud (VPC), reachable only through controlled, audited paths – not exposed directly to the open internet.
ARCHITECTURE
Databases run in private subnets with no public IP address.
Security groups restrict traffic on a deny-by-default basis.
AI requests reach Amazon Bedrock over AWS PrivateLink, not the public internet.
ACCESS CONTROL
Least-privilege IAM roles scoped per service, not per environment.
No shared or standing credentials for production access.
All administrative access is logged and attributable to an individual.
Your Data Never Trains a Model
Not by us, not by Anthropic, not by anyone – ever.
We use Claude through Amazon Bedrock rather than calling Anthropic directly. That routing matters: Bedrock runs each model provider in a dedicated, isolated deployment account that the provider itself cannot access – so Anthropic never sees your data, documents, or outputs.
HOW IT WORKS
Inference only – your content is processed to generate a response and nothing more.
No human review of prompts or outputs as part of standard operation.
Model providers cannot access the account your requests run in.
STRONGER BY DEFAULT
No reliance on a vendor’s “trust us” API terms – it’s architecturally enforced.
Same guarantee regardless of which model we route a given task to.
Fundamentally different from consumer AI tools, where inputs may improve future models.
Continuous Monitoring
Every action is watched, logged, and checked against policy – automatically, in real time.
Rather than relying on periodic manual review, we run a stack of always-on AWS services that detect threats, log activity, and flag misconfiguration as it happens.
DETECTION & AUDIT
GuardDuty — continuous threat detection across accounts and workloads.
CloudTrail – a complete, tamper-evident log of every API call and action.
CONFIGURATION & PERIMETER
Config — continuously checks infrastructure against our security baseline.
WAF — filters malicious traffic at the edge before it reaches our application.
Data Handling FAQ
Data location & residency
Where is my data stored?
Does any of our data ever leave the UK or EU?
No, not under normal operation. Storage and processing stay within UK/EU AWS regions, including AI requests, which are routed through Bedrock in-region rather than to external providers outside the UK/EU.
Are backups also kept in-region?
Yes. Backups and snapshots are stored within the same UK/EU regional boundary as the primary data — they don’t get replicated outside it.
Encryption & key management
How is our data encrypted?
Who has access to our encryption keys?
Infrastructure & certifications
Is BidReview ISO 27001 or SOC 2 certified?
We run on AWS infrastructure that’s independently certified to ISO 27001, ISO 27017, ISO 27018, and SOC 1/2/3. We don’t yet hold our own independent certification, and we’re upfront about that distinction.
Who is responsible for security?
Both, under AWS’s shared-responsibility model. AWS secures and certifies the physical infrastructure, networking, and host layers. We’re responsible for the application layer — access control, configuration, and our own codebase.
Have you had a penetration test?
An independent penetration test is on our near-term roadmap. It hasn’t been completed yet, and we’d rather say that plainly than overclaim it.
AI model training
Do you train AI models on our data?
No. We access Claude through Amazon Bedrock, which runs each model provider in an isolated account it can’t see into. Your prompts and documents are never used to train any model, by us or by Anthropic.
Does a human ever read our documents?
No, not as part of standard operation. Requests are processed for inference only – to generate a response, where an advanced human audit is requested.
Could a different AI provider see our data if you switch models?
No – the no-training, no-access guarantee comes from Bedrock’s architecture itself (isolated deployment accounts per provider), not from any single provider’s policy. It holds regardless of which model handles a given request.
Does this differ from how consumer AI tools (i.e. ChatGPT) handle data?
Yes, fundamentally. Consumer tools may use your input to improve future models. Ours is enterprise inference-only processing — your content is never retained for model improvement.
Network & access security
Is our data on a shared or public server?
No. Storage and processing run inside a private AWS Virtual Private Cloud (VPC) — databases have no public IP address and aren’t directly reachable from the internet.
Who at BidReview can access our data?
Access is restricted by least-privilege AWS IAM roles, scoped per service. There are no shared or standing production credentials, and administrative access is logged and attributable to an individual.
Do you support Single Sign-On (SSO)?
Not yet in the application today. It’s on our roadmap and we’ll prioritise it as customer demand requires.
Do you support multi-factor authentication (MFA)?
Not yet in the application today. Like SSO, it’s on our roadmap.
Monitoring & incident response
How do you detect security threats?
We run AWS GuardDuty for continuous, always-on threat detection across our infrastructure — not periodic manual review.
Is there an audit trail of what happens to our data?
Yes. AWS CloudTrail logs every API call and administrative action, giving a complete, tamper-evident record.
How do you make sure your infrastructure stays securely configured?
AWS Config continuously checks our infrastructure against our security baseline and flags drift automatically.
What happens if there's a security incident?
We don’t currently publish a fixed response-time SLA. If you need one as part of a contractual agreement, that’s something to raise directly with our team.
Compliance & legal
Are you GDPR compliant?
Our infrastructure choices — UK/EU-only data residency, encryption, access control — are built with UK GDPR and EU GDPR in mind. Related, our Data Processing Agreement (DPA) meets GDPR Article 28 requirements, covering the scope of processing, our security obligations, data subject rights support, and breach notification.
Do you provide a Data Processing Agreement (DPA)?
We’re also transparent about AI: where large language models support our services, this runs entirely within our own EU cloud environment, the model provider has no access to prompts or customer content, no data is used to train any model, and all AI-assisted output is reviewed by a person before it reaches you. Today, all processing stays within the EEA with no international data transfers.
Can we request deletion of our data ("right to be forgotten")?
An automated self-service deletion flow isn’t built yet. Deletion requests can currently be handled manually — contact your BidReview representative.