Used on more than 2,500 construction tenders and contracts
Processed in Europe by default
Documents, database and application run in the EU/EEA, with no replication or backups outside it. Europe is our core market and often has the strictest rules, so that is the standard we build to. Outside Europe, the setup is region-specific and tailored to you.
Your data stays yours
You own what you upload and what Volve generates from it. We process it to deliver the service, under the Data Processing Agreement, which is Appendix B to our Standard Terms of Sale.
Your data stays separate
Each customer’s documents, analyses and outputs are logically separated at every layer. Access is checked against your organisation and project permissions on every request.
Access is limited and logged
Only named roles can access customer content, for a defined purpose such as support you request, and every access is logged. On request, we can require your written approval first.
AI processing is purpose-limited
Third-party models run on EU endpoints, with EU-only inference as standard. They get only the excerpt each task needs and are contractually barred from training on your content. Volve itself uses only anonymised, aggregated data, as your customer agreement sets out, never your bid prices, margins or bid strategies.
Your users, your control
Enforce single sign-on through your identity provider (SAML 2.0 or OIDC) with MFA. Your administrators manage access. Network allow-listing and SIEM log delivery are available as enterprise configuration.
Protected in transit and at rest
TLS 1.2 or higher in transit and AES-256 at rest, including backups. Uploaded files are scanned for malware before processing.
Resilient
Daily backups, weekly full backups and quarterly recovery tests. If an incident affects your data, we notify you without undue delay. If you leave, your data is returned or deleted within 30 days of your instruction, confirmed in writing.
Independent assurance
ISO 27001 certification and SOC 2 attestation are in progress, with controls monitored continuously in Vanta. Live status and verified controls are in our Trust Centre.
Microsoft Azure
Document storage and cloud infrastructure
EU/EEA (West Europe, North Europe)
Google Cloud Platform
Application hosting
EU/EEA
Neon
Database: text extracts, metadata and tenant configuration
EU/EEA
Auth0 (Okta)
Identity and single sign-on
EU region
Better Stack
Logging, monitoring and alerting
EU/EEA (Prague, Czechia)
Intercom
In-app support
EU/EEA
Google Workspace
Internal email and document collaboration
EU/EEA
Stripe
Payments and invoicing, never document content
EU/EEA
Anthropic
AI inference on the excerpt each request needs. No training on customer data.
EU/EEA endpoints
OpenAI
AI inference on the excerpt each request needs. No training on customer data.
EU/EEA endpoints
Google (Gemini via Google Cloud)
AI inference on the excerpt each request needs. No training on customer data.
EU/EEA endpoints
Internal tools, such as version control, task management and sales, do not process customer content and are not listed.
LEVEL 1
Security Overview
This page, and a one-page summary to share internally.
LEVEL 2
Security Reference
The full documentation, shared when a security contact is involved: where your data lives, access, encryption, AI processing and data use, logging, incidents, recovery and enterprise configuration.
LEVEL 3
Data Processing Agreement
The binding commitments, as Appendix B to our Standard Terms of Sale, which we send to each customer before an engagement starts.