Viglia security and sub-processors

The application, its jobs and its PostgreSQL database run on a Hetzner server in Germany operated by HEPHX. Backups are encrypted on the server before leaving it.

The complete list of providers called by production code, with purpose, data received, region and residual risk. Some AI processing happens outside the European Union (China, United States). Customers are told about any addition before it goes live.

• Hetzner: Single server: application, jobs, PostgreSQL, Redis, self-hosted analytics, public site. Data: All data: accounts, client workspace data, document metadata. Region: Germany (EU). Active. Residual risk: The exact datacentre is not yet documented.
• Cloudflare R2: Document storage and encrypted backups. Data: Tender dossiers, client-uploaded documents, exports; backups encrypted before upload. Region: Region not established yet. Active. Residual risk: Apart from backups and exports, documents carry no application retention window yet.
• Lumail: Transactional and digest email. Data: Email address, display name, message content. Region: Region not established yet. Active. Residual risk: Digest content transits through this provider.
• DeepSeek: Primary language model (analysis, extraction, translation fallback). Data: Notice and document extracts, analysis inputs and client knowledge documents. Region: Outside the EU (China, per the provider). Active. Residual risk: Processed outside the EU; no-training and retention not contractually proven.
• OpenAI: Language model, vector embeddings and translation. Data: Prompt text and text submitted for embedding. Region: United States (per the provider). Active when configured. Residual risk: Processed outside the EU; retention per the provider’s API policy.
• Anthropic: Language model. Data: Prompt text (notice and document extracts, analysis inputs). Region: United States (per the provider). Active when configured. Residual risk: Processed outside the EU; used only when an account is configured.
• Vercel AI Gateway: Routing to an OpenAI-compatible model. Data: Prompt text, in transit. Region: Region not established yet. Active when configured. Residual risk: An extra intermediary when used.
• TypeSafe (Jev): Typed decisions (choice, score). Data: Public extracts and the client’s private context needed for the decision. Region: United States. Active when configured. Residual risk: US processing accepted by Viglia; zero retention not guaranteed.
• PostHog (EU Cloud): Error tracking. Data: Error traces and page URL; device identifier after consent. Region: EU. Active. Residual risk: An error trace may contain a fragment of displayed data.
• Crisp: In-app support chat. Data: Signed-in user’s identifier, email, name, organisation and role. Region: Region not established yet. Active. Residual risk: Loaded for signed-in users, outside the consent banner.
• Stripe: Subscription billing. Data: Customer email and subscription identifiers. Region: Region not established yet. Active when configured. Residual risk: No tender data is sent.
• Google (Google tag) / Meta (Meta Pixel): Advertising campaign measurement, on the public site only. Data: Page path, campaign parameters and the vendors’ own cookies; no application data. Region: The vendors’ own (independent controllers). Inactive until configured; then only after marketing consent. Residual risk: Transfer to the United States when the visitor consents.
• Oxylabs: Collection proxy for public procurement sites. Data: Requests to public sites; no client data. Region: Region not established yet. Active when configured. Residual risk: Sees Viglia’s own platform-account traffic, never client data.
• CapSolver: CAPTCHA solving on public sites. Data: CAPTCHA images from public sites; no client data. Region: Region not established yet. Active when configured. Residual risk: No client data is sent.

Every table holding a client’s data is protected by PostgreSQL row-level security, forced even on the table owner, and checked by an automated audit.

Full exports are deleted 30 days after creation. Destructive erasure of other data is not enabled yet: an erasure request is recorded today, then handled manually.

No system is free of risk. No independent penetration test has been performed yet. No-training on your data is not contractually proven for every AI provider.

Write to contact@viglia.ai. Our security.txt is published at /.well-known/security.txt.