Technical and organisational measures

2. Risk-based approach

Processing is limited to operating a free informational tool: tender fields you submit, technical request data, optional analytics after consent, and email you send us. There are no user accounts or payment card processing on this site.

Ibis Flow GmbH does not currently hold organisation-level ISO 27001 or SOC 2 certifications. Microsoft Azure maintains such certifications for its platform services. We review measures as threats and the product evolve.

3. Technical measures

3.1 Cloud hosting (Microsoft Azure)

The static site and same-origin API are hosted on Azure Static Web Apps and Azure Functions. Azure provides enterprise-grade physical, network, and platform security. Where configured, workloads are placed in EU-oriented Azure regions.

• Transport encryption: TLS for public HTTPS endpoints.
• Secrets: upstream API keys and proxy secrets stay in server configuration / environment — never in public JavaScript.
• Generic errors: client-facing API failures avoid leaking internal diagnostics.

3.2 Tender analysis path

• Same-origin POST /api/analyze forwards only limited fields (title, description, optional budget hint, locale).
• By default, submissions are not stored as permanent BidCheck or CRM records.
• Operational logs should be truncated or redacted where practical and retained only as needed for security and operations (typically ≤30 days).

3.3 Monitoring

Platform and application monitoring is event-driven. Errors and anomalies are logged and handled when they occur.

3.4 Analytics

Google Analytics 4 loads only after the visitor accepts analytics cookies. Declining does not block the evaluation tool. Tender body text is not sent as analytics event payloads.

4. Organisational measures

4.1 Organisation

Ibis Flow GmbH is owner-operated with a very small team. Production access is limited to authorised personnel. No external contractors hold standing system access for this site.

4.2 Data protection responsibilities

No formal data protection officer (DSB) is appointed. Management owns data protection and security responsibilities. Enquiries: [email protected].

5. Alle Gewerke analysis backend

When enhanced analysis is enabled, evaluation may run on the Alle Gewerke lite API operated by the same controller. Technical and organisational measures for that product surface — including Azure residency, encryption, and related controls — are described in the Alle Gewerke TOMs: alle-gewerke.de/tom. Those measures are incorporated by reference for the analysis backend.

6. Development and change management

Source code is managed in version control (Git). Changes are reviewed before production deploy. Production tender submissions are not used as fixtures in non-production environments. AI coding assistants may be used for development; they are not fed production user submissions as a matter of process.

7. Incident handling and continuity

Security and personal-data incidents are handled with appropriate urgency. Where Art. 33 GDPR requires notification of a personal-data breach to the supervisory authority, we aim to notify within 72 hours of becoming aware. Affected individuals are informed without undue delay if there is a high risk to their rights and freedoms.

Continuity benefits from Azure’s managed hosting and platform resilience for Static Web Apps and Functions.

8. Physical security

Physical security of cloud infrastructure is managed by Microsoft Azure (data centre access, monitoring, environmental controls). Company operations use secured office / remote working arrangements appropriate to a small team.

9. Continuous improvement

We review these TOMs periodically and after material changes to security practices or the analysis path. This page is updated accordingly. Related privacy information: privacy notice.