Version 1.0, effective 8 September 2026.

This page answers the questions that usually come up in security and public procurement questionnaires, and can be quoted directly.

Provider: ITAILORS - SOFT S.R.L., tax ID (CUI) 48450662, Romania. Product: Agentique (agentique.eu).

1. Where the data lives

All data is hosted in the European Union on Amazon Web Services, eu-central-1 region (Frankfurt, Germany): files, database, search index, application.
AI models (Anthropic Claude, Amazon Titan for embeddings) are called through Amazon Bedrock, exclusively in EU AWS regions.
In normal operation there is no transfer of data outside the EU/EEA.
The only exception, enabled by the customer alone: if it connects Google Drive or Google Sheets from its own Google account, the data accessed may reach Google (USA) under standard contractual clauses and the Data Privacy Framework. The integration can be revoked at any time.

2. Who can see the data

Each customer has an isolated workspace: separate search index, separate storage prefix, separate database records. Users of one customer cannot see another customer's data.
Access requires an account and an invitation code and is role-based: owner, admin, member, viewer. The customer invites and removes users itself. Passwords and API keys (MCP access) are stored only as hashes.
iTailors staff access is restricted on a need-to-know basis and subject to confidentiality. Document content is not viewed except for troubleshooting or at the customer's request.
All traffic is encrypted with TLS. Data at rest is encrypted: files in S3 with server-side encryption (AES-256) on all buckets, the RDS database is encrypted, and application secrets are protected with AWS KMS.

The assistant reads the customer's documents, answers with the source document and page, extracts data into user-defined tables and runs scheduled workflows the customer has explicitly enabled. Scanned documents are read by OCR with the same model (Claude Vision), also within the EU.
Amazon Bedrock does not store prompts or responses and does not use them for training. Data does not reach Anthropic. iTailors does not train models on customer data.
AI answers can be wrong; that is why every answer shows its source, so a person can check it. In the tender module, verdicts are recommendations only: the decision stays with a human, and the platform never submits anything to SEAP.

Documents, conversations, memories, entities and activity logs (questions, uploads, decisions recorded with user name and date): for the term of the contract, or until the customer deletes them.
User account data (name, email, role, language): for the term of the contract and a further 30 days after termination, then deleted.
Technical logs (AWS CloudWatch): 7 days. Backups: the database has automated daily backups, retained for 7 days; files are kept in AWS S3, durable storage replicated across several availability zones; they stay in the Frankfurt region.
Billing documents: 10 years, under Romanian Accounting Law no. 82/1991.
Web Assistant embedded on the customer's website, visitor conversations: retained for 30 days, for technical support and so that the institution can review them, then deleted; the institution may request earlier deletion.

The customer deletes documents, memories, entities and conversations itself, from the application, at any time.
Exports use the formats available in the application; on request, iTailors provides a full export before termination.
On termination, data is deleted from production within 30 days of termination, except for what must be kept by law (invoices). Backup copies are removed according to the rotation cycle. Written confirmation of deletion on request.
Data subject requests (access, rectification, erasure, portability) are handled by the customer from the application; iTailors assists where needed.

Contact: the address shown at agentique.eu under "Support contact". No data protection officer has been appointed, as iTailors' activities do not require one.
A security incident affecting customer data is notified to the workspace owner (owner role) without delay and within 72 hours of discovery: nature of the incident, data affected, likely consequences, measures taken. Information may come in phases.
iTailors cooperates with the customer on the investigation and, where required, on notifying the Romanian supervisory authority (ANSPDCP) and the data subjects.

No visitor tracking: agentique.eu uses no Google Analytics, Meta Pixel, Hotjar or other third-party scripts; fonts are self-hosted.
No session cookies; the authentication token and preferences live in the browser's localStorage and are never sent to third parties. No consent banner is required.
No model training on customer data. No selling or renting of data.
No card data collected: payment is by invoice issued by iTailors, settled by bank transfer within 15 days of issue.
No bids submitted to SEAP and no automated actions the customer has not explicitly enabled; any automation can be switched off at any time.

Law: GDPR, Romanian Law no. 190/2018, Law no. 506/2004. Supervisory authority: ANSPDCP (www.dataprotection.ro). For document content, the customer is the controller and iTailors the processor; for account and billing data, iTailors is the controller.
Available on request: the Data Processing Agreement (Article 28 GDPR), the sub-processor list (AWS; Google, only if connected; the SMTP server configured by iTailors, for transactional email), AWS compliance reports (ISO 27001, SOC 2), and answers to the institution's own questionnaire. SLA: during the beta period the service is provided without an availability guarantee (best effort); the platform may be unavailable at night, between 23:30 and 09:00 Romanian time, for maintenance.