Security and your documents

This page explains how the AI part of Unvexa handles your documents. Some of it is the certifications and agreements of our AI providers. The rest is our own rules. We say which is which.

Which parts of the service use an AI service, and when?

Unvexa uses commercial AI services to read documents and to draft text. This happens at three points.

1. The free fit check, before any contract: we read the buyer's request documents that you send us, such as the tender or RFP and its annexes.
2. Your own company documents, only after you confirm an order: past proposals, CVs, certificates and policies.
3. Drafting the response from those sources.

All three run under our AI providers' business (API) terms. The drafts are prepared with the help of AI systems. They are working drafts: you check, complete and submit them yourself.

Which certifications and agreements apply?

The certifications and agreements on this page are those of our AI providers' API services.

We use established commercial AI providers through their business APIs. The API service of each provider holds a SOC 2 Type II report, a SOC 3 report and ISO/IEC 27001:2022 certification, all from independent auditors.

We choose providers whose API service has independent security assurance, as described above.

Our providers are listed by category on our provider list. We name our AI provider on request.

Are my documents used to train AI models?

No. Our providers' business terms say that content sent through their API is not used to train their models unless the customer opts in. We have not opted in, and we do not use your documents to train AI models.

Does the AI provider keep my content?

For a limited time. Under their standard business terms, our providers keep API inputs and outputs for about 30 days by default, and then delete them. They may keep content for longer where the law requires it, or where their systems flag it as a possible breach of their usage policies.

How long we keep your files is set out in our privacy notice and terms: we keep the documents you send for an order, as received, and the learning copy described in section 4b of the privacy notice; they are not deleted automatically. How to ask for deletion: section 5 of the privacy notice.

Is my material kept separate from other clients' material?

Yes. This is our own rule, not a provider certification: we keep each client's material separate. Your material is never used in work for another client. Each request to our AI providers is made for one order only.

How do you handle personal data?

Your own company's personal data, such as the CVs of your key staff, is processed only after your contract with us is confirmed, never at reservation. Until then, please do not send any.

The buyer's request documents that we read for the free fit check can contain personal data too, such as contact names. They are read before a contract, under the same AI provider terms.

For your own documents, the data-processing annex to our terms applies: you are the controller and we are your processor.

Our AI providers act as our sub-processors. Their business terms include a GDPR data-processing agreement, and they process the data only to provide the service.

Clients under our data-processing annex are told in advance of a new sub-processor, as the annex sets out.

Where is my data processed?

Our AI providers may process data outside the European Union, including in the United States. Their data-processing terms cover these transfers with the EU Standard Contractual Clauses or, where one applies, an EU adequacy decision. If you want to know where a particular order is processed, write to contact@unvexa.com.

How is data protected, and what happens if something goes wrong?

• Our AI providers encrypt data in transit (TLS 1.2 or higher) and at rest (AES-256).
• They limit their staff's access to data on a least-privilege basis.
• Independent auditors review their controls every year.
• Their systems are penetration-tested at least once a year, including by outside testers.
• Each provider publishes a list of its own sub-processors and gives notice of changes.
• Their terms require them to tell us about a personal-data breach without undue delay.
• If a breach affects your data, we will tell you without undue delay.

This page reflects our AI providers' published documents as read on 30 September 2026. It covers the AI processing only. Our other processors, such as hosting and email, are listed in the privacy notice. Questions: contact@unvexa.com.

Back to reserving your place