Certified, encrypted, stored in the EU

Certifications and compliance

ISO 27001

Watchdog is certified against ISO/IEC 27001. The certificate and its scope statement are available on request — write to security@watchdog.no.

We use Drata for continuous compliance monitoring and evidence collection across endpoint protection, access configuration and policy acknowledgement. Drata does not receive, process or store customer personal data.

GDPR

Our platform ensures a lawful processing basis, strict data minimisation, and full support for data subject rights including access, rectification, erasure and portability. Customers can exercise these rights by contacting hello@watchdog.no.

Processing on your behalf is governed by our Data Processing Agreement, a standard Article 28(3) processor agreement covering sub-processors, security measures and transfer safeguards. It binds by being incorporated into the service agreement you sign, so there is no separate signature round to arrange.

Our infrastructure providers

These are certifications held by our providers, not by Watchdog — ours is the ISO/IEC 27001 above. The four the platform itself runs on hold:

That is four of our subprocessors, not all of them. The complete list — every provider, what it handles and where it processes — is our subprocessor list.

Where your data lives

Persistent customer data — the database and every stored document — is held in Stockholm, Sweden (eu-north-1). Application servers run in Stockholm and Frankfurt.

All direct subprocessors process customer data within the EU/EEA, in the locations named in our subprocessor list, and each receives only the minimum data necessary to perform its function.

Some of those providers are US-based entities, and in limited cases their own sub-processors may process data outside the EU/EEA. Where that happens it is covered by appropriate safeguards under GDPR Chapter V, including the EU Standard Contractual Clauses, as described in our Data Processing Agreement.

For customers with heightened data sovereignty requirements, we can discuss dedicated infrastructure arrangements and evaluate European-only provider alternatives.

What the AI does with your documents

Your documents never train a model

Customer data is never used to train AI models. Google Vertex AI and Datalab operate under enterprise terms that explicitly prohibit the use of customer data for model training. This is a different contractual position from consumer AI products, which is why the distinction is worth stating.

Each analysis is stateless. There is no shared context between organisations, and none between analysis runs.

How your data flows during an analysis

When an invoice or agreement is checked for compliance, it passes through three providers in order:

1. Document parsing. The document is sent to Datalab for conversion and OCR, in the Netherlands. Conversion results are deleted by Datalab at most one hour after processing completes.
2. Compliance analysis. The extracted text is sent to Google Vertex AI (Gemini) in Belgium (europe-west1) and checked against the agreement. Data is processed in memory and deleted within 24 hours.
3. Agreement search. Agreement documents are chunked and stored as text and vector embeddings in Turbopuffer (Frankfurt, eu-central-1) for semantic search, isolated in per-organisation namespaces. This is the only one of the three that stores anything; it is removed when your data is deleted.

Only what the analysis needs

Only the specific documents under analysis are sent to AI services. No customer data is stored persistently by any AI provider, and temporary staging files are cleaned up immediately after processing, with automated lifecycle rules as a safety net.

How the platform is secured

Encryption

In transit: all communication between clients, servers and third-party services is encrypted with TLS 1.3 or higher. That includes browser-to-server, server-to-database, server-to-AI-service and every webhook integration.

At rest: all persistent data is encrypted with AES-256 — database and file storage encryption managed by Supabase (AWS), and sensitive integration credentials such as OAuth tokens and API keys encrypted a second time at the application level with AES-256-GCM before storage.

Key management: encryption keys are managed by our infrastructure providers using hardware security modules. Application-level encryption keys are stored separately from customer data under strict access controls.

Four independent layers of tenant isolation

Customer data is logically isolated with defence in depth. Each layer works on its own:

1. Request authentication. Every incoming request is validated against the user's organization membership before it reaches the application. Requests for organizations the user does not belong to are rejected at the middleware level.
2. Application-level enforcement. All database queries are automatically scoped to the authenticated user's organization. No query can execute without an organization filter.
3. Database-level enforcement. Row Level Security is enabled on every table, providing an independent layer of isolation inside PostgreSQL itself.
4. Storage isolation. Documents are stored in organization-scoped paths, and access is validated against the user's organization before a time-limited signed URL (one-hour expiry) is generated.

There is no shared data between organizations at any layer. Even if one layer were compromised, the remaining three independently prevent cross-tenant access.

Access control

• Authentication via Clerk, with support for multi-factor authentication and single sign-on
• Principle of least privilege applied to all employee access
• Employees cannot access customer data except for support or legal compliance purposes; only authorized support personnel may do so, for troubleshooting, and only when the customer has asked
• All internal access is logged and monitored
• Access privileges are reviewed annually

Access to production systems is restricted to a minimal number of authorized personnel, limited to essential operations — deployment, incident response, customer support — and protected by multi-factor authentication. All staff and contractors sign confidentiality agreements and complete security awareness training.

Application security

• Mandatory code review for every change
• Automated DDoS protection via Vercel
• Webhook signature verification with HMAC and timing-safe comparison, with replay protection via timestamp validation
• Continuous compliance monitoring and evidence collection via Drata
• Vulnerability remediation targets: critical within 48 hours, high within 7 days, medium and low within 90 days

Integrations

Watchdog connects to customer accounting systems to sync invoice data. Every integration follows the same pattern:

• All integrations communicate exclusively over HTTPS
• OAuth tokens and API keys are encrypted at the application level with AES-256-GCM before storage, in addition to database-level encryption
• Inbound webhooks are verified with HMAC signature verification and timing-safe comparison
• You can disconnect any integration at any time from inside Watchdog, and can also revoke our access directly from your accounting system

Availability and recovery

• The platform targets 99.9% availability, built on providers with 99.95%+ SLAs
• Daily automated backups with point-in-time recovery via Supabase
• Recovery Point Objective: up to 24 hours of data
• Recovery Time Objective: near-instant for the application, which is serverless and has no servers to restart, and up to 4 hours for the database
• All backups are encrypted and stored within the EU
• Restore capability is tested annually

If there is an incident

• Customers are notified within 72 hours of discovery
• We provide detailed incident information, including scope and impact
• Containment and mitigation begin immediately
• Security logs are preserved for a minimum of 12 months

Reporting a vulnerability

If you find a security vulnerability, contact security@watchdog.no. We aim to acknowledge reports within 24 hours.

We ask that reporters do not access or modify other customers' data, and allow reasonable time for remediation before public disclosure.

Deleting and exporting your data

While you are a customer

Your data remains under your control and can be deleted at any time. Documents sent to AI providers are retained by them for at most 24 hours, and by Datalab for at most one hour.

When you cancel

On cancellation, all customer data is permanently deleted across every system:

• Database: every record — invoices, agreements, alerts, suppliers, settings — permanently deleted by cascading deletion
• File storage: every stored document and file permanently deleted
• Vector search: agreement embeddings and text chunks deleted from the search index
• Authentication: user and organization data removed from our identity provider
• Analytics: usage data anonymised

Deletion completes within 30 days of the request, and confirmation is provided on request.

Exporting

Invoice data can be exported directly from the application as CSV. For a full export across all data types — agreements, alerts, suppliers — contact us and we will provide it in a standard format (CSV or JSON).

What we ask of you

To keep your account secure, we ask that you:

• Keep credentials confidential and enable multi-factor authentication for all users
• Report suspicious activity promptly
• Keep systems and browsers up to date
• Ensure users are authorized for the data they can reach
• Review team member access regularly