In short
- In the EUYour documents and data are stored and processed in the European Union.
- Only your companyCustomers are strictly separated from each other in the database. This is tested with every change.
- Always two-stepLogging in requires a password and a code from your phone. For everyone, without exception.
- Not for trainingYour documents are not used to train AI models or any other software.
- We do not lookNobody at Atvalio can access your tenders, unless you grant temporary access yourself for a support question.
YOUR DATA
Where it is and who can access it
Storage in the European Union Now
The database and the files are in a data centre in Frankfurt. The website runs there too. Which parties we use is listed in the privacy statement.
Strictly separated per customer Now
The separation is in the database itself, not just in the app. Even if a screen ever has a bug, another company does not get to see your data. With every change an automatic test runs that tries to reach another customer’s data. If that attempt succeeds, the change does not go live.
Support access only with your permission At launch
If you have a question where we need to look into a tender, you grant that access yourself, for that one tender and for a limited time. Each time, who looked and when is logged. Without your permission nobody at Atvalio can access it.
Encrypted in transit and at rest Now
Every connection to Atvalio is encrypted. Stored data is encrypted as well.
You can take everything with you and have it deleted At launch
You download your tenders and bids as Word or PDF. If you stop, we delete your data after the period set out in the terms.
LOGGING IN
Who is who
Two-step verification required Now
Besides your password, Atvalio always asks for a code from an authenticator app. It cannot be switched off, not even by an administrator. The database itself refuses every request without that second step.
Strong passwords Now
At least twelve characters, with upper case, lower case, digits and symbols. Changing a password is only possible if you logged in recently and know your current password.
Roles per user Now
An administrator decides who may do what: administrator, member or viewer. An organisation always keeps at least one administrator.
AI
What the AI does and does not do
Atvalio uses Claude, the AI model by Anthropic, to read tenders and suggest texts.
Processing in the EU, not for training At launch
The model runs through Amazon Bedrock, in data centres in the European Union. Your documents do not go to a public chat service and are not used to train the model.
Advise, not decide Design rule
Atvalio makes reasoned suggestions. You decide and you submit. No feature can send or submit anything on your behalf.
Always with a source Design rule
Every piece of advice refers to a page in the documents, a field in your profile or a web page. If information is missing, Atvalio asks a question instead of making something up.
Text in documents is never an instruction Design rule
An uploaded document may contain text that tries to steer the AI. Atvalio treats everything from documents as content to read, never as an instruction to carry out.
CONCERNS ABOUT AI
What people ask us about AI
Fair questions. These are our answers, without small print.
Can my competitor get at my texts through the AI?
No. The model has no memory shared between customers. With every request it only receives the documents and profile of your organisation, and that separation is enforced in the database. Even if your competitor uses Atvalio for the same tender, the AI on their side sees nothing of yours.
Does the model learn from my documents?
No. Your documents are not used to train the model, not by us and not by the provider. After your tender the model is exactly the same as before.
Do my documents go to ChatGPT or another public service?
No. Atvalio uses Claude through Amazon Bedrock, in data centres in the European Union. That is a business environment, separate from public chat services. Amazon does not store the requests and responses there and does not use them for training.
What if the AI makes something up?
A language model can do that, and that is why we have a rule for it. Every piece of advice must refer to a page in the documents, a field in your profile or a web page, and the software checks that the source really exists. No source, no advice. If information is missing, Atvalio asks a question. And you read and approve everything before anything goes out.
Can someone mislead the AI with a document?
Someone could put text like "ignore your instructions" in a document. Atvalio treats everything from uploaded documents as content to read, never as an instruction. The AI also cannot send, submit or pass anything to other customers; all it does is make suggestions in your environment.
Who is responsible for what is submitted?
You are. Atvalio advises and drafts suggestions; you decide, edit and submit yourself. That is not a disclaimer but a design choice: no feature can submit anything on your behalf.
HOW WE BUILD
Security with every change
Every change is tested Now
No change goes live without automatic checks: customer separation, the permissions in the database and known vulnerabilities in the components used. If one fails, the change does not go live. Nobody can skip that.
Independent reviews Now
At set moments the entire code is reviewed for vulnerabilities, separately from the build. The latest review was on 1 November 2026; all findings have been resolved.
No secrets in the code Now
Keys and passwords are never in the code, only encrypted at the services that need them.
Strict rules in the browser Now
The website only runs its own scripts, cannot be embedded in another site and only talks to its own services.
FOR THE CISO
The details your IT department wants to know
The same commitments as in the data processing agreement.
Subprocessors
| Party | Purpose | Location |
|---|---|---|
| Supabase | Database, login, document storage | Frankfurt |
| Vercel | Hosting of the web application | Frankfurt |
| Amazon Web Services | AI processing (Claude through Amazon Bedrock) | European Union |
| Microsoft | Atvalio email | European Union |
| Resend | Sending Atvalio emails | Ireland |
We announce a new party at least 30 days in advance. If you have a reasonable objection, you can cancel.
Data breaches: notice within 48 hours Commitment
If a security incident affects personal data, the administrator of your account is informed within 48 hours of discovery, with what we know about the nature, the consequences and the measures.
Audit log At launch
Important actions are logged: logins, agreements, who opened which tender and every time support access was used.
Backups At launch
Daily backups, encrypted and within the EU, so data can be restored after an outage.
Retention and deletion Commitment
After your subscription ends you have 30 days to download everything. After that we delete your data within 30 days, including from backups. On request we confirm this in writing.
Review and audit Commitment
On request you receive a description of the measures and the results of the security reviews. Once a year you may have an independent audit carried out at your own cost.
Log in with your own Microsoft account Later
For larger organisations, login through Microsoft (single sign-on) is coming. Until then, two-step verification at Atvalio itself is required.
REPORT A VULNERABILITY
Found something? Let us know
Report it here. Your report arrives straight away as a ticket. We respond within two working days and keep you informed until it is resolved. Please do not make it public before it is resolved, and do not look at other people’s data.
TO BE FAIR
What we do not have yet
- Atvalio is a young company, still being incorporated. We do not have an ISO 27001 certificate or a SOC 2 report. The parties we build on do.
- Atvalio Tenders is still in development. What is labelled "At launch" above, we are building now, and it will be there when you can start.
- If anything here changes, you will see it on this page, with the date.
YOUNG COMPANY
Why that need not be a concern
- Built by someone from the field. Atvalio was founded by a director with years of experience in European public tenders and private tenders. We build what we needed ourselves.
- Small, and therefore fast. No layers, no hand-offs. A question or report goes straight to the person who decides, and is answered within two working days.
- On large, proven providers. Storage, hosting and AI run at providers that are certified themselves and serve thousands of companies worldwide. We add strict rules on top, not experiments of our own.
- Carefully controlled. Every change is tested automatically before it goes live, and the code is reviewed independently at set moments.
- You are never locked in. You can always download your tenders and bids as Word or PDF. If your subscription ends, or if Atvalio were ever to stop, you have 30 days to take everything with you.
For your IT department or procurement
Everything you need to assess Atvalio, without a call.
Last updated on 1 November 2026.