Certified, encrypted, stored in the EU

Certifications and compliance

ISO 27001

Watchdog is certified to ISO/IEC 27001:2022 by Insight Assurance. The certificate and its scope statement are available on request — write to security@watchdog.no.

We are not certified against ISO/IEC 27017 or ISO/IEC 27018.

We run continuous compliance monitoring and evidence collection on a compliance platform we host ourselves. It covers access configuration, policy acknowledgement and evidence for our controls, and it does not receive, process or store customer personal data.

GDPR

Our platform ensures a lawful processing basis, strict data minimisation, and full support for data subject rights including access, rectification, erasure and portability. Customers can exercise these rights by contacting hello@watchdog.no.

Processing on your behalf is governed by our Data Processing Agreement, a standard Article 28(3) processor agreement covering sub-processors, security measures and transfer safeguards. It binds by being incorporated into the service agreement you sign, so there is no separate signature round to arrange.

Our infrastructure providers

These are certifications held by our providers, not by Watchdog — ours is the ISO/IEC 27001 above. Six of the providers the platform runs on hold:

That is six of our subprocessors, not all of them. The complete list — every provider, what it handles and where it processes — is our subprocessor list.

Where your data lives

Primary data storage is in the EU. The database is held in Stockholm, Sweden (eu-north-1), stored documents are held in Cloudflare R2 under EU jurisdiction, and AI agent state is kept under Cloudflare's EU jurisdiction. The web application runs in Stockholm and Frankfurt, and the API runs next to the database in Stockholm. Requests reach it through Cloudflare's global network, which connects each user through the nearest data centre for speed and DDoS protection, without storing anything along the way.

AI analysis is stateless. Google Vertex AI and Amazon Bedrock process each request in memory and keep nothing once it completes: no prompts, no answers, no copies of your documents. Because nothing is stored, every analysis can run on the providers' full global capacity. That gives you their newest models as soon as they are released, the headroom to process large volumes quickly, and analysis that keeps running when a single region is busy.

Not every provider processes data in the EU/EEA. Authentication data — names, email addresses, organisation membership and sessions — is held by Clerk in the United States. Web searches made during an analysis go to Exa in the United States; only the search queries are sent, never your documents. Every provider, what it handles and where it processes is in our subprocessor list, and each receives only the minimum data necessary to perform its function.

Several of our providers are US-based entities, and in limited cases their own sub-processors may process data outside the EU/EEA. Where a provider processes data outside the EU/EEA, including in-memory AI analysis, the transfer is covered by appropriate safeguards under GDPR Chapter V, including the EU-US Data Privacy Framework and the EU Standard Contractual Clauses, as described in our Data Processing Agreement.

For customers with heightened data sovereignty requirements, we can discuss dedicated infrastructure arrangements and evaluate European-only provider alternatives.

What the AI does with your documents

Your documents never train a model

Customer data is never used to train AI models. Google Vertex AI, Amazon Bedrock and Datalab operate under enterprise terms that explicitly prohibit the use of customer data for model training. This is a different contractual position from consumer AI products, which is why the distinction is worth stating.

There is no shared context between organisations.

How your data flows during an analysis

When an invoice or agreement is checked for compliance, it passes through these providers:

1. Document parsing. The document is sent to Datalab for conversion and OCR, processed in the Netherlands. Conversion results are deleted by Datalab at most one hour after processing completes.
2. AI analysis. The extracted text is checked against the agreement by Google Vertex AI (Gemini), and invoices are classified and price lists extracted by Amazon Bedrock. Both process the request in memory and store nothing.
3. Web search. Where an analysis needs public information, it searches the web through Exa, in the United States. Only the search queries are sent, never your documents.
4. Agreement search. Agreement documents are chunked and stored as text and vector embeddings in Turbopuffer (Frankfurt, eu-central-1) for semantic search, isolated in per-organisation namespaces. They are removed when your data is deleted. The embeddings are generated by Google Vertex AI, which stores nothing.

AI requests run through our AI agent runtime and AI gateway on Cloudflare. Agent state is kept under Cloudflare's EU jurisdiction for up to 7 days. Our AI request logs hold metadata only, such as timings, token counts and costs, never your documents or the AI's answers, and are kept in our own Cloudflare account for a limited rolling period.

Only what the analysis needs

Only the specific documents under analysis are sent to AI services, and those services keep nothing: Google Vertex AI and Amazon Bedrock store no prompts or answers. Temporary staging files are cleaned up immediately after processing, with automated lifecycle rules as a safety net.

How the platform is secured

Encryption

In transit: all communication between clients, servers and third-party services is encrypted with TLS 1.2 or higher, using TLS 1.3 wherever the other side supports it. That includes browser-to-server, server-to-database, server-to-AI-service and every webhook integration.

At rest: all persistent data is encrypted with AES-256 — database encryption managed by Supabase (AWS), document storage encryption managed by Cloudflare R2, and sensitive integration credentials such as OAuth tokens and API keys encrypted a second time at the application level with AES-256-GCM before storage.

Key management: encryption keys are managed by our infrastructure providers using hardware security modules. Application-level encryption keys are stored separately from customer data under strict access controls.

Tenant isolation

Customer data is logically isolated per organization:

1. Request authentication. Every incoming request is validated against the user's organization membership before it reaches the application. Requests for organizations the user does not belong to are rejected at the middleware level.
2. Scoped database queries. Every database query is scoped to the customer's organization in the application layer.
3. Scoped document storage. Documents are stored under per-organization paths, and access is validated against the user's organization before a time-limited signed URL (one-hour expiry) is generated.

There is no shared data between organizations.

Access control

• Authentication via Clerk, with support for single sign-on
• Multi-factor authentication with an authenticator app (TOTP), with backup codes for recovery
• Organization admins can require multi-factor authentication for the whole organization; the requirement also applies to API keys
• Principle of least privilege applied to all employee access
• Employees cannot access customer data except for support or legal compliance purposes; only authorized support personnel may do so, for troubleshooting, and only when the customer has asked
• All internal access is logged and monitored
• Access privileges are reviewed annually

Access to production systems is restricted to a minimal number of authorized personnel, limited to essential operations — deployment, incident response, customer support — and protected by multi-factor authentication. All staff and contractors sign confidentiality agreements and complete security awareness training.

API access

The Watchdog API is a REST/JSON API described with OpenAPI 3.1. It authenticates with personal API keys, each scoped to selected organizations. There is no OAuth for the API.

Application security

• Mandatory code review for every change
• Automated DDoS protection via Cloudflare and Vercel
• Webhook signature verification with HMAC and timing-safe comparison, with replay protection via timestamp validation
• Continuous compliance monitoring and evidence collection on a self-hosted compliance platform
• Vulnerability remediation targets: critical within 48 hours, high within 7 days, medium and low within 90 days

Penetration testing

In April 2026 an independent third party tested app.watchdog.no against the OWASP Top 10 and the SANS Top 25. The test found no critical, high, medium or low-severity issues, and two informational findings. We run an independent penetration test every year. The report is available on request — write to security@watchdog.no. Requests are reviewed manually.

Logging

• Sign-in and session events are recorded by Clerk, our authentication provider
• Changes to invoices, agreements, alerts and claims are logged with who made them, what changed and when
• API key creation and revocation are recorded
• Operational logs are kept for 30 days and error data for 90 days
• Logs related to a security incident are kept for at least 12 months

Integrations

Watchdog connects to customer accounting systems to sync invoice data. Every integration follows the same pattern:

• All integrations communicate exclusively over HTTPS
• OAuth tokens and API keys are encrypted at the application level with AES-256-GCM before storage, in addition to database-level encryption
• Inbound webhooks are verified with HMAC signature verification and timing-safe comparison
• You can disconnect any integration at any time from inside Watchdog, and can also revoke our access directly from your accounting system

Availability and recovery

• Daily automated database backups, kept for 7 days, encrypted with AES-256 and stored in Stockholm
• Documents are stored in Cloudflare R2 with the provider's built-in redundancy, and deleted documents can be recovered for 30 days
• Recovery Point Objective: up to 24 hours of data
• Recovery Time Objective: near-instant for the application, which is serverless and has no servers to restart, and up to 4 hours for the database
• Restore capability is tested annually

If there is an incident

• Customers are notified within 72 hours of discovery
• We provide detailed incident information, including scope and impact
• Containment and mitigation begin immediately

Reporting a vulnerability

If you find a security vulnerability, contact security@watchdog.no. We aim to acknowledge reports within 24 hours.

We ask that reporters do not access or modify other customers' data, and allow reasonable time for remediation before public disclosure.

Deleting and exporting your data

While you are a customer

Your invoices, agreements and their files are kept while you use Watchdog, and you can delete them at any time. Files you remove, or that your accounting system replaces, and invoices and agreements you delete are erased within 30 days. AI providers retain nothing from the documents sent to them, and Datalab deletes conversion results within one hour.

When you delete your workspace

Deleting your workspace removes it at once: no one can open it, and syncs and all other processing stop. For 7 days we can restore it if you ask us to. After that, all customer data is permanently deleted across every system:

• Database: every record — invoices, agreements, alerts, suppliers, settings — permanently deleted by cascading deletion
• File storage: every stored document and file permanently deleted
• Vector search: agreement embeddings and text chunks deleted from the search index
• Authentication: user and organization data removed from our identity provider
• Analytics: usage data anonymised

Deleted data leaves our backups 7 days later, so everything is gone within 14 days of the request, inside the 30 days our DPA commits to. We keep only billing records, which contain no document content. When your agreement ends, we delete your data the same way at your request and can confirm the deletion.

Exporting

Invoice data can be exported directly from the application as CSV. For a full export across all data types — agreements, alerts, suppliers — contact us and we will provide it in a standard format (CSV or JSON).

What we ask of you

To keep your account secure, we ask that you:

• Keep credentials confidential and enable multi-factor authentication for all users
• Report suspicious activity promptly
• Keep systems and browsers up to date
• Ensure users are authorized for the data they can reach
• Review team member access regularly