Security

Last updated: August 2026

Our Commitment

Watchdog is built to handle sensitive financial data — invoices, contracts, and agreements. Security is foundational to our platform, not an afterthought. We are committed to:

• European data sovereignty — persistent customer data remains in the EU; Clerk processes authentication data in the United States under SCCs, while Better Stack stores primary error data and source maps in Germany and may process or permit access from the United States and other locations under DPF and/or SCC safeguards (see our subprocessor list)
• GDPR compliance — full compliance with EU data protection regulations
• Zero AI training — customer data is never used to train AI models
• Enterprise-grade encryption — AES-256 at rest, TLS 1.3 in transit

Compliance & Certifications

GDPR Compliance

Our platform ensures lawful processing basis, strict data minimization, and full support for data subject rights including access, rectification, erasure, and portability. Customers can exercise these rights by contacting hello@watchdog.no.

Industry Standards

Our infrastructure providers maintain the following certifications:

Watchdog is currently pursuing ISO 27001 certification, targeted for Q2 2026. A third-party penetration test was completed in April 2026. SOC 2 Type II audit initiation is planned for H2 2026. We use Drata for continuous compliance monitoring and evidence collection.

Infrastructure & Data Residency

Persistent customer data is stored within the European Union. Direct processing locations are listed in our subprocessor list. Clerk processes authentication data in the United States under SCCs. Better Stack stores primary production-error data and source maps in Germany, while Better Stack and its disclosed subprocessors may process or access that data from the United States and other locations under DPF and/or SCC safeguards. Other subprocessors' own subprocessors may also process data outside the EU/EEA under appropriate safeguards.

Persistent customer data remains stored in the European Union.

Security Controls

Encryption

In transit: All communication between clients, servers, and third-party services is encrypted with TLS 1.3 or higher. This includes browser-to-server, server-to-database, server-to-AI services, and all webhook integrations.

At rest: All persistent data is encrypted with AES-256:

• Database encryption managed by Supabase (AWS)
• File storage encryption managed by Supabase (AWS)
• Sensitive integration credentials (OAuth tokens, API keys) are additionally encrypted at the application level with AES-256-GCM before storage

Key management: Encryption keys are managed by our infrastructure providers using hardware security modules (HSM). Application-level encryption keys are stored separately from customer data with strict access controls.

Multi-Tenant Isolation

Customer data is logically isolated with defense in depth across four independent layers:

1. Request authentication: Every incoming request is validated against the user's organization membership before reaching the application. Requests for organizations the user does not belong to are rejected at the middleware level.
2. Application-level enforcement: All database queries are automatically scoped to the authenticated user's organization. No query can execute without an organization filter.
3. Database-level enforcement: Row Level Security (RLS) is enabled on all database tables, providing an independent layer of tenant isolation at the PostgreSQL level.
4. Storage isolation: Documents are stored in organization-scoped paths. Access is validated against the user's organization before generating time-limited signed URLs (1-hour expiry).

There is no shared data between organizations at any layer. Even if one layer were compromised, the remaining layers independently prevent cross-tenant data access.

Access Control

• Authentication via Clerk with support for Multi-Factor Authentication (MFA) and Single Sign-On (SSO)
• Principle of least privilege applied to all employee access
• Employees cannot access customer data except for support or legal compliance purposes
• All internal access is logged and monitored
• Annual access privilege reviews

Personnel Security

All staff and contractors sign confidentiality agreements and complete security awareness training.

Application Security

• Continuous compliance monitoring and evidence collection via Drata
• Mandatory code reviews for all changes
• Automated DDoS protection via Vercel
• Webhook signature verification with HMAC and timing-safe comparison to prevent replay and spoofing attacks
• Vulnerability remediation targets: Critical (48 hours), High (7 days), Medium/Low (90 days)
• Third-party penetration testing completed in April 2026, with regular testing thereafter

Integration Security

Watchdog integrates with customer accounting systems to sync invoice data. Each integration follows a consistent security pattern:

• All integrations communicate exclusively over HTTPS
• Read-only access only — Watchdog never modifies data in the customer's accounting system
• OAuth tokens and API keys are encrypted at the application level with AES-256-GCM before storage, in addition to database-level encryption
• Customers can disconnect any integration at any time through the Watchdog interface, and can also revoke access directly from their accounting system
• Inbound webhooks are verified with HMAC signature verification and timing-safe comparison, with replay protection via timestamp validation

Internal Access Controls

Access to production systems is restricted to a minimal number of authorized personnel. Production access is:

• Limited to essential operations (deployment, incident response, customer support)
• Protected by multi-factor authentication
• Subject to annual access reviews

Backup, Disaster Recovery & Availability

• The platform targets 99.9% availability, built on providers with 99.95%+ SLAs
• Daily automated backups with point-in-time recovery via Supabase
• Recovery Point Objective (RPO): up to 24 hours of data
• Recovery Time Objective (RTO): near-instant for the application (serverless — no servers to restart), up to 4 hours for the database
• All backups encrypted and stored within the EU
• Annual restore capability testing

AI-Powered Document Processing

Zero Training Policy

Customer data is never used to train AI models. Google Vertex AI, Amazon Bedrock, and Datalab operate under enterprise terms that explicitly prohibit the use of customer data for model training. This is distinct from consumer AI products.

How Data Flows During Analysis

When invoices and agreements are analyzed for compliance:

1. Document parsing: Text documents are sent to Datalab for document conversion and OCR in the EU (Netherlands). Conversion results are deleted by Datalab at most one hour after processing completes.
2. Compliance analysis: Extracted text is sent to Google Vertex AI (Gemini, Belgium) and/or Amazon Bedrock (Stockholm) in the EU for analysis. Data is processed in memory and deleted within 24 hours. Each analysis is stateless — there is no shared context between organizations or between analysis runs.
3. Agreement search: Agreement documents are chunked and stored as text and vector embeddings in Turbopuffer (Frankfurt) for semantic search. Data is isolated in per-organization namespaces.

Data Minimization in AI Processing

• Only the specific documents under analysis are sent to AI services
• No persistent storage of customer data by AI providers
• Temporary staging files are cleaned up immediately after processing, with automated lifecycle rules as a safety net

Data Lifecycle & Privacy

Data Retention

• Customer data remains under your control and can be deleted at any time
• AI-processed documents are retained for a maximum of 24 hours by AI providers

Data Deletion

Upon account cancellation, all customer data is permanently deleted across every system:

• Database: All records (invoices, agreements, alerts, suppliers, settings) are permanently deleted via cascading deletion
• File storage: All stored documents and files are permanently deleted
• Vector search: Agreement embeddings and text chunks are deleted from the search index
• Authentication: User and organization data is removed from our identity provider
• Error monitoring: Production exception data is deleted in accordance with the configured retention and account-deletion process

Full deletion is completed within 30 days of a cancellation request. Confirmation of deletion is provided upon request.

Data Export

Invoice data can be exported directly from the application in CSV format. For full data exports across all data types (agreements, alerts, suppliers, etc.), contact us and we will provide your data in standard formats (CSV/JSON).

Data Minimization

We collect only the data necessary to provide our invoice compliance services. Customer data is not used for any secondary purpose without explicit notice and consent.

Production error monitoring is limited to errors and the structured operational context needed to diagnose them. This can include organization names/IDs, entity IDs, and relevant invoice, agreement, alert, supplier, amount, currency, date, status, provider, request/run, and filename metadata. Release identifiers and uploaded JavaScript/TypeScript source maps are used to map stack traces back to application source locations. Authorization and cookie headers, secrets, raw bodies and documents, payment or national identifiers, AI prompts/outputs, and user email/name are excluded. Primary error data and source maps are stored in Better Stack's Germany region and follow the configured monitoring retention and account-deletion process; Better Stack and its disclosed US/global subprocessors are covered by DPF and/or SCC safeguards where applicable.

Third-Party Services & Subprocessors

Direct processing locations are listed in our subprocessor list, and each provider receives only the minimum data necessary to perform its function. Clerk processes authentication data in the United States under SCCs. Better Stack stores primary production-error data and source maps in Germany, while Better Stack and its disclosed subprocessors may process or access that data from the United States and other locations under DPF and/or SCC safeguards. Other subprocessors' own subprocessors may also process data outside the EU/EEA under appropriate safeguards.

For the complete list including purpose, data handled, and processing locations, see our subprocessor list.

International Data Transfers

Persistent customer data is stored within the EU (Stockholm, Sweden). Clerk processes authentication data in the United States under SCCs. Better Stack stores primary production-error data and source maps in Germany, while Better Stack and its disclosed subprocessors may process or access that data from the United States and other locations under DPF and/or SCC safeguards. Other subprocessors' own subprocessors may also process data outside the EU/EEA under appropriate safeguards, as described in our Data Processing Agreement (see our subprocessor list).

Certain subprocessors store and process customer data within the EU/EEA but are US-owned, and their personnel may access EU-stored data for support and operational purposes — this applies to Supabase (storage), Datalab (OCR), Vercel (hosting), and Better Stack (production error monitoring). We treat such access as a transfer to the United States and cover it under an applicable adequacy decision, the EU-US Data Privacy Framework (DPF), and/or the EU Standard Contractual Clauses (SCCs).

For details on our legal transfer mechanisms and safeguards, see our Data Processing Agreement.

For customers with heightened data sovereignty requirements, we can discuss dedicated infrastructure arrangements and evaluate European-only provider alternatives.

Incident Response & Security Reporting

Security Incidents

In the event of a security incident:

• Customer notification within 72 hours of discovery
• Detailed incident information provided including scope and impact
• Immediate containment and mitigation actions
• Security logs preserved for a minimum of 12 months

Vulnerability Reporting

If you discover a security vulnerability, please contact us at security@watchdog.no. We target acknowledgment within 24 hours.

We ask that reporters:

• Do not access or modify other customers' data
• Allow reasonable time for remediation before public disclosure

Customer Responsibilities

To maintain the security of your account, we ask that customers:

• Keep credentials confidential and enable MFA for all users
• Report suspicious activities promptly
• Maintain updated systems and browser versions
• Ensure users have appropriate data access authorization
• Review and manage team member access regularly

Frequently Asked Questions

Is my data used for AI training?

No. Google Vertex AI, Amazon Bedrock, and Datalab operate under enterprise data governance terms that explicitly prevent customer data from being used for model training. Documents are processed in memory and deleted within 24 hours.

Can Watchdog employees access my data?

Only authorized support personnel may access customer data for troubleshooting purposes, and only when requested by the customer. There is no routine employee access to customer data.

Where is my data stored?

Persistent data (database and files) is stored in Stockholm, Sweden (eu-north-1). Application servers run in Stockholm and Frankfurt. Processing locations for document extraction, AI analysis, and other subprocessors are listed in our subprocessor list.

Some of your providers are US companies. How do you handle international data transfers?

Persistent customer data is stored within the EU. Clerk processes authentication data in the United States under SCCs. Better Stack stores primary production-error data and source maps in Germany, while Better Stack and its disclosed subprocessors may process or access that data from the United States and other locations under DPF and/or SCC safeguards. Several other subprocessors are US-based entities, and their own subprocessors may also process data outside the EU/EEA under appropriate safeguards, as described in our Data Processing Agreement. For customers with heightened sovereignty requirements, we can discuss dedicated infrastructure and European-only alternatives.

What happens when I cancel?

All customer data is permanently deleted across all systems — database, file storage, vector search, and authentication — within 30 days of cancellation. Invoice data can be exported from the application before cancellation, and full data exports across all data types are available on request. We provide confirmation of deletion.

Do you have ISO 27001 certification?

We are currently pursuing ISO 27001 certification. Our infrastructure providers (Google Cloud, Supabase, Vercel, Clerk) maintain ISO 27001 and/or SOC 2 Type II certifications.

How is tenant isolation enforced?

We use four independent layers of isolation: request-level authentication, application-level organization scoping, database-level Row Level Security (RLS) on all tables, and storage-level path isolation. There is no shared data between organizations at any layer.