SteinlogSecurity & data residency
A bid worth millions
deserves the boundaries.
Tender documents are commercially sensitive and, in a consortium, competitively so. Steinlog is built so the safe thing is the default: documents and databases stay in the EU, isolated per client, on the record, and out of AI training.
Posture, in one line
EU-pinned docs/DB · Ireland (EU) assistant inference · OCR/embeddings disclosed (may leave EU) · one DB per client · append-only history · no training on your data · least-privilege access · export anytime
EU-pinned docs & database storage
Your documents and database are stored in the EU and isolated per client. Assistant inference (xAI) runs in Ireland via a regional EU endpoint and never trains on your data. Search embeddings (Voyage) and scanned-file OCR (Datalab) are disclosed subprocessors that may process outside the EU — see the table below.
One database per client
Each client gets an isolated database — not a shared table with a tenant column. Cross-client access is structurally impossible, not just policy.
Append-only history
Every change is written to an append-only, hash-linked record. Nothing is silently overwritten or deleted; the history can be independently verified.
No training on your data
Your tender and bid content is never used to train AI models. The assistant reads your project on demand and only to answer you.
Access model
Least privilege,
by construction.
The most sensitive boundary in a consortium bid is between the lead's own material and what partners can see. Steinlog enforces it structurally, and logs every access so trust between companies is a record, not a favour.
Subprocessors
Who touches your data.
A short supply chain. Documents and databases stay in the EU. Assistant inference runs in Ireland (EU regional endpoint). Voyage (embeddings) and Datalab (OCR for scans) may process outside the EU and are listed below as such. The DPA and current subprocessor list are available before a pilot begins.
| Provider | Purpose | Region |
|---|---|---|
| Cloudflare | Cloud services | EU |
| AWS | Cloud services | EU |
| xAI | Assistant inference | EU (Ireland) |
| Voyage | Embeddings / search indexing | May leave EU |
| Datalab | OCR (scanned files) | May leave EU |
| PostHog | Analytics | EU |
Analytics run only after you accept them, and never carry bid content.
Export anytime
Every version, change and access, as one archive. No lock-in.
Delete on request
Ask us to delete a project or your account and we do, across primary storage.
DPA available
A data processing agreement is available for signature before a pilot begins.
Security questions for a pilot? Write to security@steinlog.com.
Security
Bring it to your
IT and legal team.
We'll answer the security questionnaire and sign the DPA before a single document is uploaded.
pilot@steinlog.com