Security & Trust

Encrypted, documented, and auditable.

Security

Security built in.

Your bids hold your best work. This is how it is kept safe, on every plan, with nothing for you to set up.

Your data

  • Encrypted in transit with TLS 1.3 and at rest with AES-256.
  • Each organisation's data is kept separate by the database itself, using row level security.
  • Stored in Ireland, in the EU, with daily backups.
  • Export or delete your own data whenever you like.

Signing in

  • Passkeys and multi factor sign in.
  • Single sign on and SCIM user provisioning on every plan.
  • See and end your sessions, and admins can end a member's sessions.
  • An audit log records who did what.

Checked automatically

  • Rate limiting on the API and strict security headers on the app.
  • Dependency vulnerability checks every week.
  • Security and secret checks on every code change.
  • Automated monitoring with daily failure alerts.

System status: status.velstrian.com

How Velstrian protects your bid documents, company data, and user accounts: enterprise encryption, data stored in the EU (Ireland), and transparent AI processing boundaries.

Every layer, from disk to API, is named and auditable.

Operational standards

The controls every Velstrian organisation inherits by default, from encryption to data residency to regulatory registration.

AES-256 encryption at rest

AES-256 encryption at rest across the database, file storage and backups, with keys managed by our hosting provider. Stored integration credentials get our own AES-256-GCM encryption on top.

TLS 1.3 in transit

Forward-secret HTTPS on every request with HSTS preload. TLS 1.3 is used wherever the browser supports it, and TLS 1.2 otherwise.

GDPR compliant

Subject rights supported end to end, with lawful basis, retention and deletion documented. Our Data Processing Agreement is published, and is still a draft pending legal review.

EU data residency

Primary customer data is stored in the EU, in AWS eu-west-1 (Ireland). Our API runs in the EU and the web application runs in the UK. Full processing locations are listed under sub-processors below.

Follows ISO/IEC 27001

We follow ISO/IEC 27001 and review every Annex A control in our own Statement of Applicability.

ICO Registered Data Controller

Velstrian Systems Ltd is registered with the Information Commissioner’s Office as a data controller.

Security documentation

The detail behind each control, written for security and procurement teams. Jump to any topic, or contact us for an audit pack.

AES-256 encryption

All customer data is encrypted at rest using AES-256, and in transit using TLS 1.2 or higher, with TLS 1.3 wherever the browser supports it. Disk encryption keys are managed by our infrastructure providers. Application credentials and API keys are rotated by us, on a documented procedure with a verification step before the old key is revoked. Database snapshots, file storage, and backups inherit the same protection.

At rest
AES-256
In transit
TLS 1.3 where supported, TLS 1.2 minimum, HSTS
Disk key rotation
Provider managed
Application key rotation
Documented procedure
Backups
Encrypted

EU data residency

  • Your account and bid data, sign in records and uploaded files are stored by Supabase in AWS eu-west-1 (Ireland), with daily backups.
  • The Velstrian API and its background worker run on Railway in europe-west4 (the Netherlands).
  • The web application runs on Vercel in London (lhr1).
  • Error monitoring runs in the EU (Sentry, Germany) and product analytics in the EU (PostHog EU Cloud).
  • Other processors operate under Standard Contractual Clauses (SCCs).
  • AI is the one part that leaves the EU. We send only the text a task needs to Google Gemini and Anthropic Claude, and neither lets us choose a UK or EU location. AI data handling below says where each one processes it and under what contract. The full list is below and matches our Sub-processors page.
Sub-processors
Supabase
EU (Ireland), database, authentication and file storage
Railway
EU (Netherlands), the API and background worker
Vercel
UK (London), web application hosting
Cloudflare
Global edge, SCC, DNS, CDN and bot protection
Stripe
US and EU, SCC, payments
PostHog
EU, product analytics
Sentry
EU (Germany), error monitoring
Brevo
EU, email delivery
Google Gemini
Not region pinned, international transfer under contract, AI drafting
Anthropic Claude
Global, no UK or EU option, international transfer under contract, the buyer pre-read
Tawk.to
US, SCC, live chat support
Calendly
SCC, meeting scheduling links
Microsoft Azure Document Intelligence
Dormant / Optional, activated only if specific document intelligence features are enabled by the customer, text recognition on scanned documents

GDPR compliance

  • Velstrian Systems Ltd is registered as a data controller with the Information Commissioner’s Office (ICO) under the Data Protection (Charges and Information) Regulations 2018.
  • Our Data Processing Agreement (DPA) is published for customers. It is in draft pending legal review, so its terms may still change.
  • Data subject rights supported: right to erasure, data portability, restriction of processing, and access.
ICO contact & registration

Registered with the Information Commissioner's Office as a data controller.

Data requests: [email protected]

Access controls

Platform access is enforced in depth: organisation-scoped roles at the application layer, Row-Level Security at the database, and multi-factor authentication available to every user at the identity layer.

RBAC

  • Org-scoped roles: Owner, Admin, Member.
  • Privileged actions audit-logged.
  • People join an organisation only when one of its admins adds them.

RLS

  • Row-Level Security enforced in Postgres.
  • Org isolation at query time.
  • Tenant data scoped to each organisation via RLS.

MFA

  • TOTP available for every account.
  • Session revocation on demand.

ISO 27001 controls

We follow ISO/IEC 27001 and review every Annex A control in our own Statement of Applicability. OWASP practices are applied to all application development. The control set, the risk register, the statement of applicability, the internal audit and the management review are maintained as documents and are available on request.

AI data handling

AI runs through server-side API calls from our own API only. Drafting, document reading, search and the chat assistants use Google Gemini models (the current generation Gemini text models and Gemini embeddings). The buyer pre-read in Velstrian Buy and our checks on the quality of drafted answers use Anthropic’s current Claude models. Both are data sub-processors. The boundaries below describe exactly what crosses to a model provider.

In plain words, how Velstrian uses AI sets out what the AI does in each product, the checks it runs and how you stay in control.

What is sent
  • The text the active task needs: tender documents, your answers, your library, documents you upload, or what you type into a chat.
  • This can contain personal data, such as a name in a CV. We do not remove it before sending.
  • Server-side API calls only.
What is NOT sent
  • Bulk exports or full organisation datasets.
  • Passwords, authentication tokens or payment details.
Where it is processed
  • Google Gemini: the Gemini API offers no region setting, and Google may store or cache the text in any country where it or its agents have facilities.
  • Anthropic Claude: Anthropic's global service, with no UK or EU option.
Under what contract
  • Google Gemini: Google's Gemini API terms.
  • Anthropic Claude: Anthropic's Commercial Terms with Anthropic Ireland, Limited, which include the EU Standard Contractual Clauses and the UK International Data Transfer Agreement. By default Anthropic does not train on what we send, and deletes it within 30 days, or up to 2 years if it is flagged for a usage policy breach.
  • We treat both as international transfers, protected as our Privacy Policy sets out.
Model Usage & Data Isolation
AI calls are made only from our own API, under Velstrian's own provider accounts. Prompts include only the text the active task needs. Every call is recorded in our cost and audit ledger with the model and provider used.

Vulnerability disclosure

Report security vulnerabilities responsibly to [email protected] with the subject “Security Disclosure”. We acknowledge receipt within two business days and triage as below. These are targets we set ourselves, not a contractual service level.

On a narrow screen, this table scrolls sideways.

Severity Examples Triage target Patch target
Critical RCE, auth bypass 1 business day 5 days
High Privilege escalation 2 business days 14 days
Medium CSRF, XSS 3 business days 30 days
Low Hardening findings 5 business days Best-effort

Uptime target

99.5%

Velstrian targets 99.5% monthly uptime, with independent public status monitoring you can check yourself.

View status page

Deep dives

Sub-processors list

The same list as above, with what each one does.

  • Supabase (EU, Ireland), database, authentication and file storage.
  • Railway (EU, Netherlands), the API and background worker.
  • Vercel (UK, London), web application hosting.
  • Cloudflare (global, SCC), DNS, CDN and DDoS protection.
  • Stripe (US and EU, SCC), billing and payment processing.
  • PostHog (EU Cloud), product analytics, event metadata.
  • Sentry (EU, Germany), error monitoring.
  • Brevo (EU), transactional email delivery.
  • Google Gemini (not region pinned, under Google's Gemini API terms), AI drafting, document reading, search and the chat assistants.
  • Anthropic Claude (global, under Anthropic's Commercial Terms with Anthropic Ireland, Limited), the buyer pre-read.
  • Tawk.to (US, SCC), live chat support.
  • Calendly (SCC), meeting scheduling links.
  • Microsoft Azure Document Intelligence (dormant, optional), text recognition on scanned tender documents. Activated only if specific document intelligence features are enabled by the customer.
Severity levels in detail

Our severity model follows CVSS 3.1 base scoring, adjusted for environmental impact across multi-tenant data isolation.

  • Critical: active exploitation paths affecting confidentiality or integrity of customer data.
  • High: escalation paths within an authenticated session.
  • Medium: targeted attacks requiring user interaction or constrained scope.
  • Low: defensive hardening, configuration drift, or informational findings.

Company & regulatory details

ICO registration
Registered Data Controller
Company
Velstrian Systems Ltd
Registered
England and Wales
Data controller
Velstrian Systems Ltd
General Enquiries
[email protected]
Security
[email protected]
Data request contact
For erasure, portability, restriction, or access requests, email [email protected]. We respond within statutory timeframes.

Finished your review?

Everything above is what we can show you today. If it meets your needs, the next step is a live workspace. If you need a control you do not see here, ask us and we will tell you plainly where it stands.

Start now Book a 30-minute demo

ICO-registered data controller. EU data residency. AES-256 at rest, TLS 1.3 in transit. Follows ISO/IEC 27001. GDPR compliant.

Privacy Policy Sub-processors Status Page