BidReview Trust Centre

You spend all day answering security questionnaires.
Here’s ours.

BidReview.ai runs on AWS infrastructure, keeps your bid data inside the UK and Ireland, and never lets a model learn from your content. Below is exactly how – claim by claim, with the technical detail behind each one.

Hosted on AWS Europe

Zero AI training on your data

Full audit trail, every action

How we protect your data

Enterprise Grade Encryption

Every byte of data is encrypted at rest and transit – no exceptions.

Encryption is enforced end to end using AWS-native key management – there’s no point between your browser and our storage layer where data sits unencrypted.

AT REST

L
K
AES-256 encryption on all storage (database, file, and backup layers).
Encryption keys managed and rotated automatically via AWS KMS.
Backups and snapshots inherit the same encryption by default.

IN TRANSIT

L
K

TLS 1.2+ enforced on every API and browser connection.


HSTS enabled to prevent downgrade to unencrypted HTTP.


Certificate lifecycle managed via AWS Certificate Manager.

KEY MANAGEMENT

L
K

Keys held in AWS KMS, never embedded in application code.


Access to keys restricted by least-privilege IAM policy.


All key usage logged for audit via CloudTrail.

EU Data Residency

Your data stays in Frankfurt, an EU AWS regions – it never leaves our borders.

We host in AWS’s  Frankfurt region, so storage and processing happen on infrastructure physically located in Ireland – satisfying both UK GDPR and EU GDPR data localisation expectations without a separate compliance project.

REGULATORY FIT

L
K

Aligned to UK GDPR for UK-based customer data.


Aligned to EU GDPR for Ireland/EU-based customer data.


No reliance on cross-border transfer mechanisms (SCCs) for in-region processing.

IN TRANSIT

L
K

TLS 1.2+ enforced on every API and browser connection.


HSTS enabled to prevent downgrade to unencrypted HTTP.


Certificate lifecycle managed via AWS Certificate Manager.

Certified Infrastructure

We build  on AWS infrastructure independently certified to the standards your procurement team already trusts.

Under the AWS shared-responsibility model, AWS secures and certifies the physical infrastructure, networking, and host layers – and we build BidReview.ai directly on top of that certified foundation, inheriting its assurance while we focus on securing the application layer ourselves.

INHERITED FROM AWS

L
K

ISO 27001, 27017 (cloud security) and 27018 (cloud privacy).


SOC 1, SOC 2, and SOC 3 reports covering the underlying infrastructure.


CSA STAR and PCI DSS Level 1 certified data centres.

BIDREVIEW LAYER

L
K

Application-level access control, identity, and configuration.


Secure software development practices for our own codebase.


A first independent penetration test is on our near-term roadmap.

Isolated, Locked-down Network

Your data sits in a private network boundary – never directly reachable from the public internet.

Storage and processing run inside a private AWS Virtual Private Cloud (VPC), reachable only through controlled, audited paths – not exposed directly to the open internet.

ARCHITECTURE

L
K

Databases run in private subnets with no public IP address.


Security groups restrict traffic on a deny-by-default basis.


AI requests reach Amazon Bedrock over AWS PrivateLink, not the public internet.

ACCESS CONTROL

L
K

Least-privilege IAM roles scoped per service, not per environment.


No shared or standing credentials for production access.


All administrative access is logged and attributable to an individual.

Your Data Never Trains a Model

Not by us, not by Anthropic, not by anyone – ever.

We use Claude through Amazon Bedrock rather than calling Anthropic directly. That routing matters: Bedrock runs each model provider in a dedicated, isolated deployment account that the provider itself cannot access – so Anthropic never sees your data, documents, or outputs.

HOW IT WORKS

L
K

Inference only – your content is processed to generate a response and nothing more.


No human review of prompts or outputs as part of standard operation.


Model providers cannot access the account your requests run in.

STRONGER BY DEFAULT

L
K

No reliance on a vendor’s “trust us” API terms – it’s architecturally enforced.


Same guarantee regardless of which model we route a given task to.


Fundamentally different from consumer AI tools, where inputs may improve future models.

Continuous Monitoring

Every action is watched, logged, and checked against policy – automatically, in real time.

Rather than relying on periodic manual review, we run a stack of always-on AWS services that detect threats, log activity, and flag misconfiguration as it happens.

DETECTION & AUDIT

L
K

GuardDuty — continuous threat detection across accounts and workloads.


CloudTrail – a complete, tamper-evident log of every API call and action.

CONFIGURATION & PERIMETER

L
K

Config — continuously checks infrastructure against our security baseline.


WAF — filters malicious traffic at the edge before it reaches our application.

Data Handling FAQ

Data location & residency

Where is my data stored?

L
K
We host in AWS’s Frankfurt region, so storage and processing happen on infrastructure physically located in Ireland – satisfying both UK GDPR and EU GDPR data localisation expectations without a separate compliance project.

Does any of our data ever leave the UK or EU?

L
K

No, not under normal operation. Storage and processing stay within UK/EU AWS regions, including AI requests, which are routed through Bedrock in-region rather than to external providers outside the UK/EU.

Are backups also kept in-region?

L
K

Yes. Backups and snapshots are stored within the same UK/EU regional boundary as the primary data — they don’t get replicated outside it.

Encryption & key management

How is our data encrypted?

L
K
All documents uploaded to BidReview.ai are encrypted both in transit and at rest using industry-standard encryption protocols. Data is protected while being transferred to our platform and remains encrypted while stored, helping ensure the confidentiality and integrity of your tender documents throughout the review process.

Who has access to our encryption keys?

L
K
Encryption keys are managed using secure cloud key management services and are not directly accessible to BidReview.ai users. Access is tightly controlled, monitored and restricted to authorised operational processes, following the principle of least privilege. This helps ensure that sensitive customer data remains protected at every stage of its lifecycle.

Infrastructure & certifications

Is BidReview ISO 27001 or SOC 2 certified?

L
K

We run on AWS infrastructure that’s independently certified to ISO 27001, ISO 27017, ISO 27018, and SOC 1/2/3. We don’t yet hold our own independent certification, and we’re upfront about that distinction.

Who is responsible for security?

L
K

Both, under AWS’s shared-responsibility model. AWS secures and certifies the physical infrastructure, networking, and host layers. We’re responsible for the application layer — access control, configuration, and our own codebase.

Have you had a penetration test?

L
K

An independent penetration test is on our near-term roadmap. It hasn’t been completed yet, and we’d rather say that plainly than overclaim it.

AI model training

Do you train AI models on our data?

L
K

No. We access Claude through Amazon Bedrock, which runs each model provider in an isolated account it can’t see into. Your prompts and documents are never used to train any model, by us or by Anthropic.

Does a human ever read our documents?

L
K

No, not as part of standard operation. Requests are processed for inference only – to generate a response, where an advanced human audit is requested.

Could a different AI provider see our data if you switch models?

L
K

No – the no-training, no-access guarantee comes from Bedrock’s architecture itself (isolated deployment accounts per provider), not from any single provider’s policy. It holds regardless of which model handles a given request.

Does this differ from how consumer AI tools (i.e. ChatGPT) handle data?

L
K

Yes, fundamentally. Consumer tools may use your input to improve future models. Ours is enterprise inference-only processing — your content is never retained for model improvement.

Network & access security

Is our data on a shared or public server?

L
K

No. Storage and processing run inside a private AWS Virtual Private Cloud (VPC) — databases have no public IP address and aren’t directly reachable from the internet.

Who at BidReview can access our data?

L
K

Access is restricted by least-privilege AWS IAM roles, scoped per service. There are no shared or standing production credentials, and administrative access is logged and attributable to an individual.

Do you support Single Sign-On (SSO)?

L
K

Not yet in the application today. It’s on our roadmap and we’ll prioritise it as customer demand requires.

Do you support multi-factor authentication (MFA)?

L
K

Not yet in the application today. Like SSO, it’s on our roadmap.

Monitoring & incident response

How do you detect security threats?

L
K

We run AWS GuardDuty for continuous, always-on threat detection across our infrastructure — not periodic manual review.

Is there an audit trail of what happens to our data?

L
K

Yes. AWS CloudTrail logs every API call and administrative action, giving a complete, tamper-evident record.

How do you make sure your infrastructure stays securely configured?

L
K

AWS Config continuously checks our infrastructure against our security baseline and flags drift automatically.

What happens if there's a security incident?

L
K

We don’t currently publish a fixed response-time SLA. If you need one as part of a contractual agreement, that’s something to raise directly with our team.

Compliance & legal

Are you GDPR compliant?

L
K

Our infrastructure choices — UK/EU-only data residency, encryption, access control — are built with UK GDPR and EU GDPR in mind. Related, our Data Processing Agreement (DPA) meets GDPR Article 28 requirements, covering the scope of processing, our security obligations, data subject rights support, and breach notification.

Do you provide a Data Processing Agreement (DPA)?

L
K
Yes. We provide a Data Processing Agreement (DPA) that meets GDPR Article 28 requirements, covering the scope of processing, our security obligations, data subject rights support, and breach notification. Our use of sub-processors is fully documented, each is bound by written terms as protective as our own DPA, and we remain fully accountable for their performance — all EU-based, with a named contact for any data protection query.

We’re also transparent about AI: where large language models support our services, this runs entirely within our own EU cloud environment, the model provider has no access to prompts or customer content, no data is used to train any model, and all AI-assisted output is reviewed by a person before it reaches you. Today, all processing stays within the EEA with no international data transfers.

Can we request deletion of our data ("right to be forgotten")?

L
K

An automated self-service deletion flow isn’t built yet. Deletion requests can currently be handled manually — contact your BidReview representative.

Data Lifecycle

What happens to our documents after an analysis is complete?

L
K
Once your analysis is complete, your documents remain securely stored within your BidReview.ai account so you can revisit previous submissions, compare results and access historical reports. All uploaded files continue to be protected using the same security controls applied throughout their lifecycle.

Can we delete our data?

L
K
Yes. Customers retain control of their own data and can request the deletion of uploaded documents and associated analysis results. Once a deletion request has been processed, the data is removed in accordance with our data retention and deletion procedures.

How long is customer data retained?

L
K
Customer data is retained only for as long as necessary to provide the service, meet legal or contractual obligations, and support legitimate business operations. Retention periods are governed by our internal data management policies, after which data is securely deleted in accordance with established deletion procedures.