Security, privacy and compliance

01Compliance built into Orbecta

Procurement data says a lot about a company: suppliers, prices, contract terms and where it is under pressure. Anyone who entrusts that information to a platform wants to know where it lives and who can access it. That is why compliance at Orbecta is not an appendix but part of the product. We built Orbecta so that access is the exception, not the rule.

Your data under the GDPR

Our data processing agreement applies to every customer, and our sub-processors are on a fixed list. Logs and chat history are cleaned up automatically according to fixed retention periods. If you delete your account, your data and attachments go with it. Read more about how we process personal data in our privacy statement.

Responsible AI

Orbecta uses AI to analyse claims, contracts and supplier meetings. We follow the EU AI Act and document how we use AI: see AI transparency.

02Security

• Isolated per user. Every claim, contract and Warroom session is isolated in the database: only you see your own data. In a team, your administrator decides per module what colleagues can see. Only the person who created something can change or delete it. AI chat conversations always stay personal.
• Encrypted. Database and files are stored encrypted (AES-256); all traffic runs over encrypted connections (TLS/HTTPS).
• Private file storage. Attachments are kept in private storage, separated per user, and can only be opened through temporary links.
• Two-factor authentication. Mandatory for Orbecta administrators; you can enable it for your own account in your profile.
• Checked AI requests. Every AI function verifies that you are signed in and that the record is yours. Documents are treated as data, never as instructions to the AI.
• Limits that cannot be bypassed. Plans and monthly limits are enforced in the database; users cannot change their own plan or limit.
• Web security. HTTPS enforced with HSTS, a Content Security Policy and protection against injected malicious code (XSS).

Signing in with your organisation's company account (SSO, for example Microsoft or Google) is available on request.

03AI transparency

Orbecta uses Claude by Anthropic for its analyses. The AI supports your work; the decision always stays with you.

What the AI does

• Claim Check assesses any type of claim between you and a supplier, such as price increases, surcharges and quality claims (NCR), using market data and earlier claims as evidence, and gives a substantiated recommendation.
• Supplier Warroom prepares a briefing, agenda and questions for a supplier meeting.
• Contract Intelligence analyses contracts for risks, obligations and deadlines.
• Orbecta AI chat answers questions about markets, suppliers and your own data.

What the AI does not do

• Make decisions, contact suppliers or send anything on your behalf.
• Use your data to train models: Anthropic does not do this by default for business customers (source).
• Include other customers' data. Each request only contains that one claim, session or contract. An anonymous benchmark with other customers is off by default and can only be switched on per user.

Oversight and control

• Every AI analysis is recorded in an audit log: when, which function, which model and how many tokens. No prompts or AI text are stored in that log.
• You can see your own AI activity in your profile and download it as CSV.
• Scores and outcomes are checked in code, so a deviating AI answer cannot slip through unnoticed.

By default Orbecta uses Anthropic's own Claude API, because new Claude models are available there first and the features the analyses rely on work there directly and fully. Processing then takes place in the US. What this means for your data:

• Kept briefly. Anthropic automatically deletes inputs and outputs within 30 days (source).
• Legally covered. The transfer to the US is covered by the EU Standard Contractual Clauses.
• Certified. Anthropic holds ISO 27001:2022, ISO/IEC 42001:2023 (AI management) and SOC 2 Type II (source); reports can be requested through Anthropic's Trust Portal.

AI processing within the EU (Claude via AWS Bedrock or Google Cloud in an EU region) is available on request.

04Sub-processors

Orbecta uses the following providers. When we add a new sub-processor, we notify our business customers in advance, with the option to object.

Transfers outside the EU are based on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

05Retention

Customer data stays as long as you keep it. Logs and chats are cleaned up automatically every night.

When an account is deleted, all personal data goes with it: contracts, claims, Warroom sessions, attachments, AI chats, usage and team membership. Only the AI audit log and the email log remain until their retention period ends. You can request an export of your own data.

06Data processing agreement

Our data processing agreement under the GDPR applies to every customer. You remain the owner of your data; Orbecta only processes it on your instructions. It covers:

• Purpose. We only use your data to deliver the modules you use: analysis, monitoring and reporting.
• Which data. User contact details, contract, claim and supplier data, attachments and AI results.
• No training. Your data is not used to train AI models, neither by Orbecta nor by our AI provider.
• Sub-processors. The list above; new sub-processors are notified in advance, with the right to object.
• Transfers outside the EU. Based on the EU Standard Contractual Clauses.
• Security. The measures on this page.
• Data breaches. We inform you within 48 hours.
• Retention and deletion. According to the retention periods above; export of your own data on request.
• Audit. You may have our security assessed; we provide the Security and Privacy Pack and the reports of our certified providers.

The full text is on the data processing agreement page. It forms part of our terms and applies automatically when you create an account. Want a signed copy, or does your organisation use its own template? Email us.

07Incidents and data breaches

If something goes wrong, you hear it from us, quickly and in full. In case of a (suspected) security incident, we act as follows:

1. Establish. What happened, which data and which customers are affected, and since when?
2. Contain. We close the leak: replace keys, revoke access and take a function or page offline where needed.
3. Inform you within 48 hours. What happened, which data is involved, which measures we have taken and who your contact person is. This lets you, as the controller, report within the legal deadline where required.
4. Recover. We fix the cause, verify that the leak is really closed and restore data from a backup where needed.
5. Record. Every incident goes into our incident register, even if no notification was required.
6. Evaluate. Within two weeks we determine what prevents a recurrence.

Report a security issue

Noticed something that is not right, or found a vulnerability? Email us with a short description. We respond as quickly as possible and keep you informed.

08Documents and contact

Our Security and Privacy Pack gives your IT, security and privacy team all the details: architecture, sub-processors, AI use, security measures, retention periods and the incident procedure.