For your reviewer
Security questionnaire — pre-answered
The answers a standard vendor assessment asks for, published up front. Print this, or send it to whoever runs your review.
01 · Hosting & residency
Where it runs.
- Where is customer data hosted on the standard plan?
- Frankfurt, in the EU. Compute and managed PostgreSQL on Fly.io; object storage on Cloudflare R2.
- Do you offer a dedicated deployment?
- Yes — a single-tenant deployment inside the EU, provisioned on signed demand. It is not the default plan.
- Is an on-premise deployment available?
- Yes. The on-prem edition runs entirely inside your network and is the only configuration with genuine zero egress.
- Which markets do you serve?
- The European Union only. EstiWright is not offered, marketed or supported in the United Arab Emirates, Saudi Arabia or Qatar, or elsewhere outside the EU.
02 · Isolation & access
How tenants are separated.
- How is multi-tenant data segregated?
- PostgreSQL Row-Level Security with
FORCE ROW LEVEL SECURITYon every tenant table. Enforcement is in the database, not application code. - Can a bug in your application expose another tenant's data?
- The application connects as a non-owner role without
BYPASSRLS, and the active tenant is set inside each transaction. A query that omits the tenant filter returns zero rows rather than another tenant's. - What authentication is supported?
- Single sign-on or short-lived signed tokens. Access and refresh tokens are separate and type-checked.
- What roles exist?
- Super-admin, local-admin, engineer and viewer, with guards preventing a tenant from removing its own last administrator.
03 · AI handling
What the models see.
- Do you train models on our data?
- No. Tender content, requirements and pricing are never used to train any model. This is contractual.
- Which AI providers do you use?
- Anthropic for inference on the hosted plans. The on-prem edition can run entirely against a local model you approve.
- Can we restrict which tasks use a cloud model?
- Yes — routing is configurable per task, so extraction can run locally while a harder drafting task uses a cloud model, or not at all.
- Is AI output reviewed before it is used?
- Always. The AI drafts and a person approves; every sign-off is recorded and attributable.
04 · Certifications & assurance
The part most vendors skip.
- Do you hold SOC 2?
- Not yet. We will publish the auditor and report date when the observation window closes rather than claim it early.
- Do you hold ISO 27001 or ISO 42001?
- Neither is certified today. The ISMS follows ISO 27001's structure; we do not claim a certificate we cannot produce.
- Has the platform been penetration tested by a third party?
- Not yet commissioned. When it is, we will publish the tester and date.
- Can we get a DPA?
- Yes, on request. The standard plan processes inside the EU.
- What happens to our data if we leave?
- Projects, requirements, approvals and the audit trail export as a single file, on demand, without a support ticket.
Something not covered here?
Send the questionnaire. We'll answer against the actual architecture and tell you plainly where a control isn't in place yet.