Security and data residency

The application database, uploaded documents and backups are held in Switzerland. Model inference uses named, contractually bound interfaces. The processing location and contractual boundaries are disclosed before contract. With the separately available Swiss Inference option, the model environment and inference also run in Switzerland. Customer content is not used to train third-party models; the exclusion is recorded contractually. ISO 27001 and ISO 27018 are used as an internal control framework. This is a self-declaration, not certification or independent assurance; the current evidence status is disclosed during the security review.

Status and scope

Last content review: 2026-08-07. These statements cover customer content in the Tendaro product. Contact and demo-request data submitted through the website is described separately in the privacy notice and is not part of the product.

Established: Applies as described here.
In the security review: Before contract, per configuration, with evidence status.

What applies to Tendaro

Established. Standard and Swiss Inference differ in where the model environment and inference run. The Swiss commitment covers the elements named here explicitly.

Application database. Standard: Switzerland. Swiss Inference: Switzerland.
Uploaded documents. Standard: Switzerland. Swiss Inference: Switzerland.
Backups. Standard: Switzerland. Swiss Inference: Switzerland.
Model inference. Standard: Contractually bound interfaces; processing location disclosed before contract. Swiss Inference: Switzerland.
Training on customer content. Standard: Contractually excluded. Swiss Inference: Contractually excluded.
Approval before submission. AI modules provide suggestions, not automated decisions. Bid managers review, amend and approve content before it enters a submission.
Audit log. An audit log is included in every configuration.
ISO 27001 and 27018 (self-declaration). ISO 27001 and ISO 27018 are used as an internal control framework. This is a self-declaration, not certification or independent assurance; the current evidence status is disclosed during the security review.

What the security review covers

In the security review. For your configuration, the security review discloses whether and to what extent these points are in place and evidenced. What applies is confirmed before contract.

Sign-in and roles. Which sign-in options, roles and approvals are available, and whether and to what extent SSO and MFA are provided. This depends on the configuration and agreed deployment.
Support access. Whether support access is possible and which approval, time and logging boundaries apply. This is recorded contractually.
Tenant isolation. How the architecture, isolation, storage boundaries and role model are set up for your configuration, each with its evidence status.
Encryption. Which controls apply to transport, storage and key management, with the protocol in use, ownership and evidence status.
Logging scope. Which events the audit log records, who can access it, whether export is available and how long logs are retained.
Data protection documents. Whether, and in which version, a data processing agreement, subprocessor list, processing register and data-flow description are available.
Independent assessment. Whether a current independent assessment report exists, with its assessment date, scope and status. This page claims neither an available report nor a recurring assessment cycle.
Export and deletion. Which export options and retention periods apply and how the deletion process works at contract end.
Availability and recovery. Architecture, recovery objectives and recovery procedures, specified in the agreed service levels. The values in the applicable contract govern.

How the security review works

1. Request documents. Write to info@tendaro.ch and request the current document inventory and evidence status.
2. Receive the status of each item. The response identifies whether each requested item is available, under review or not yet available and whether an NDA applies.
3. Record the configuration. Before contract, the configuration, providers, region, retention periods and further contractual boundaries are specified in the security dossier and data processing agreement.

Frequently asked questions

Can inference run entirely in Switzerland?

Yes, with the separately agreed Swiss Inference option: the model environment and inference then also run in Switzerland. On Standard, the application database, uploaded documents and backups stay in Switzerland, and model inference runs through contractually bound interfaces. The applicable configuration is recorded before contract.

Which configuration does our tender require?

That depends on the exact wording of the tender. A data-storage requirement is not the same as a requirement that every processing operation take place in Switzerland. Before contract, Tendaro maps the wording to Standard or Swiss Inference and documents the agreed boundary.