Security
Where your data is, who can see it and how you can check
Before you trust us with your data, your supplier auditor will ask you the questions you ask your own suppliers. Here they are, each with our answer and where you can check it.
Request informationWhere is my data?
As SaaS, in a virtual machine just for you on OVH Public Cloud, in European Union data centres; backups and monitoring at Hetzner, also in the EU. On-premise, on your servers: it never leaves your infrastructure.
Where the proof isThe list of subprocessors
Which third parties see my data?
As SaaS, only European companies: OVH, Hetzner and Scaleway, for the platform's emails; no third party outside the EU handles your data. On-premise, none. If you choose to sign in with your Google or Microsoft account, they see your name and email at sign-in, and nothing else.
Where the proof isThe list of subprocessors, with each one’s country
Do you run my data through a third-party AI?
No. Almenara does not use third-party AI on its customers’ data. AI suggests and a person decides: we are developing and training the in-house models that will do it. If you want to use a third-party model, you connect your own with your own key, and that processing is yours to decide and contract.
Where the proof isThe list of subprocessors: there is no AI provider
Is my data mixed with other customers’ data?
No. As SaaS, each customer has its own virtual machine, separate from other companies’. Your suppliers come in through their portal and only see their own questionnaires.
Where the proof isThe SaaS and on-premise comparison, below
Who can sign in and what do they see?
Everyone signs in with a password and the platform’s multi-factor authentication or, if they prefer, with their corporate Google or Microsoft account and the MFA their organisation has set up there. Permissions are role-based: everyone sees only what concerns them.
Where the proof isThe information security policy
Will I know who changed what?
Yes. Every change is recorded with author, date and version, the same record your auditor will ask you for.
Where the proof isThe demo: every step, with its time and who signs it
Who do I tell if I find a vulnerability?
Write to hola@getalmenara.com. The responsible disclosure procedure is published in the standard security.txt format.
Where the proof issecurity.txt
Where it runs
SaaS in the EU or on-premise: you decide where your data lives
The same platform and the same modules, in two places. What changes is where it runs and who operates it.
SaaS
In the EU cloud, run by us
- Where the data lives
- In a virtual machine just for you on OVH Public Cloud, in European Union data centres. Backups and monitoring at Hetzner, also in the EU.
- Third parties outside the EU
- None with your data: OVH, Hetzner and Scaleway, which sends the platform's emails, are European and their data centres are in the EU. Only if you choose to sign in with your Google or Microsoft account do they see your name and email at sign-in.
- Access
- Our own MFA, or your Google or Microsoft account
- Who runs it
- Our team runs everything: nothing to install or maintain.
- Updates
- Automatic, with nothing for you to do.
- AI
- No third-party AI with your data. The in-house models we are training will arrive as an update; if you want to use another, you connect your own with your key.
- A good fit if
- You want to start quickly, with no infrastructure of your own.
On-premise
On your servers, with your data never leaving your premises
- Where the data lives
- In your infrastructure: your data never leaves your premises.
- Third parties outside the EU
- None: the platform does not take data out of your infrastructure.
- Access
- Our own MFA, or your Google or Microsoft account
- Who runs it
- Your systems, with set-up and maintenance handled by our team.
- Updates
- We apply them, coordinated with your team.
- AI
- Ready to run locally the models we are training, without taking data out.
- A good fit if
- Your policy requires data to stay inside: banking, public sector or critical operators.
In both: the four modules, the supplier portal at no cost to suppliers and traceability of every change. Services are contracted separately and work with either.
Our certifications, in preparation
We’re preparing our own management system for ISO/IEC 27001 and ENS certification. We aren’t certified yet: when we are, you’ll see each seal here with the body that issued it.
ISO/IEC 27001In preparation
Working towards ISO/IEC 27001 with our information security management system.
ENSIn preparation
Preparing the certificate of conformity with Spain’s National Security Framework.
Need more detail for your assessment? Ask us for the data processing agreement and the answers to your security questionnaire through the contact form.