Security & Trust
Built on three pillars: time-limited tender projects, no AI training, and enterprise-grade security controls.
Each tender gets a project with a deletion timer. You can run multiple analyses while it is open. When the timer ends, the project is deleted. We keep only what legal, billing, and security obligations require.
We do not use customer data to train AI models, internally or with providers. Bid files are processed for the review in an isolated environment, then removed when the tender project timer ends.
Encrypted at rest and in transit, built on Google Cloud infrastructure, aligned with ISO 27001 best practices.
We're actively working toward formal certifications. We share progress transparently while operating with strict controls around data handling, privacy, and AI governance.
We're preparing for ISO 27001 certification to provide trust in our information security management.
We're preparing for ISO 42001 certification, giving customers confidence in how we build and run AI.
We're preparing for a SOC 2 Type I audit to verify the design of our security and privacy controls.
We operate in strict accordance with GDPR data privacy principles and EU data residency.
Security monitoring snapshot
A scan of the controls we run across our code and infrastructure.
Updated March 2026.
Our platform is built on world-class Google Cloud infrastructure, designed with multiple layers of defense to protect your data at every stage.
At Rest
All data stored in our environment is encrypted at rest using industry-standard AES-256.
In Transit
All data transmitted between you and Midpilot, and within our internal network, is encrypted using TLS 1.2 or higher.
Logical Isolation
Each client's data and analysis runs in a completely separate, logically isolated cloud environment. This architecture is designed to strictly isolate your data and mitigate the risk of cross-contamination.
European Data Residency
Our core AI processing and data storage infrastructure is configured to operate within the European Union, consistent with GDPR requirements.
World-Class Infrastructure
We build on top of Google Cloud's certified infrastructure (e.g., ISO 27001, SOC 2), inheriting their world-class physical and environmental security controls. These certifications apply to Google Cloud's infrastructure. Our own organizational certifications are listed above.
Privacy-First Access by Default
Bid content is primarily processed by the AI system and delivered as reports with citations. Human access is restricted by default and limited to necessary operational or support cases under internal controls.
Principle of Least Privilege
Internal access is strictly governed by the Principle of Least Privilege. Team members are only granted access to the specific systems required to perform their roles.
Multi-Factor Authentication
All access to our internal systems and infrastructure requires multi-factor authentication.
Fewer moving parts: files in, reports out.
Install is optional
You can send files directly. Endpoint install is not required. If you share via SharePoint or OneDrive, we connect through a read-only Microsoft 365 integration. Access is scoped only to the folders you share, with no write access and no broader tenant permissions.
No Client-Side User Management
You don't need to worry about provisioning new user accounts, managing passwords, or offboarding former employees.
A Clear, Auditable Process
The service is easy to understand and audit. We provide a clear data lifecycle from start to finish.
We welcome and encourage deep security reviews from our clients' technical teams. If you have further questions or would like to see our detailed security documentation, please get in touch.
Request a Security Briefing