Security pack

Storage in the EU

The room, the knowledge bank and the files are stored with Supabase Inc.: EU – AWS eu-north-1 (Stockholm); support access from third countries may occur.

Private files

The files are in private storage. Only your company’s signed-in users and Brickstream’s AI team read them – never another customer. A file you remove is erased at once; the room’s own files are erased 90 days after the room is locked.

AI without training

The questions, the requirements review and the files’ text are processed by Anthropic PBC (USA) under the commercial terms: model training on the content is blocked, with a DPA and standard contractual clauses.

Data processing agreement

A data processing agreement template, the security description and the sub-processor list are in the security pack – to read and download without a call.

The reviewer

A reviewer reads only what you send for review, in the platform and under a confidentiality agreement – nothing is downloaded.

The security pack · The privacy notice

Brickstream AB, reg. no. 556792-7644, Linköping, Sweden · Version 2026-10-16 · Contact: info@brickstream.se (subject "Security")

This description covers Brickstream’s fixed-price services (for example Bid support, Requirements review, Test cases and Supplier questionnaires – security, quality and environment), the free sample and the platform app.brickstream.se, as built and configured on the version date. We state openly what is not yet in place (section 11).

1. Overview

The full list with safeguards and agreements is in the Sub-processors document. Brickstream has no server room of its own, and we need no access to your systems: you send files.

2. Your material in an order or a free sample

• Storage: the files are kept in private storage in Stockholm that only your order can reach. Upload and download use short-lived signed links. Encrypted in transit (TLS) and at rest.
• No e-mail attachments: we never send material or deliveries as attachments. You download the delivery in the platform, and the free sample through a download link valid for 30 days.
• Who sees it: the AI team during the run and, in an order, Brickstream’s senior final reviewer. The final reviewer works under a non-disclosure agreement, reads and corrects in the platform with two-step sign-in and cannot download the files; every opening is logged. No other consultants and no other customers see anything. Two competitors in the same tender never get the same reviewer.
• Only for your order: the material never improves deliveries to another customer and is not used in any knowledge base, template or example. The AI team is trained on published tenders – never on your material.
• Erasure: the material and the delivery are erased automatically 30 days after delivery, and at once if the order is cancelled or declined. A free sample and its documents are erased at the latest 30 days after the sample has been delivered or declined. Only what the Swedish Accounting Act requires remains.
• Brickstream’s internal AI assistant (for operations, development and e-mail) never opens customers’ material in assignments.

3. What we do not accept

Security-classified information or material under a security protection agreement, and export-controlled technical information (for example military equipment, dual-use items, ITAR or EAR). In a free sample we also do not accept sensitive personal data or personal identity numbers. The platform searches for classification and export-control markings before the work starts; on a hit the work stops, the files are erased and we contact you. Other personal data is no obstacle – you decide yourselves whether to mask names under your policy.

4. AI processing

• The AI team calls Anthropic’s models (Claude) through Anthropic’s commercial API – not a chat app or consumer service.
• The content is not used to train the models (Anthropic’s commercial terms).
• Processing currently takes place in the USA, under the European Commission’s standard contractual clauses in Anthropic’s data processing terms. At the AI provider, inputs and outputs are deleted within 30 days; longer only if something is flagged for breaching the provider’s usage policy.
• AI processing in the EU is prepared (Claude through Amazon Bedrock in Stockholm, eu-north-1, with an EU profile that keeps processing within the EU). It is not switched on yet. On the day it is switched on, this description, the sub-processor list and the privacy notice are updated. If your policy requires processing in the EU, tell us before you upload anything.
• During the run the AI team has no access to the internet or to other customers’ data. Text in your material is treated as data: instructions in it are not followed.
• Everything the AI team produces in an order is final-reviewed by a person. The free sample is an AI draft that is not final-reviewed and is marked as such.

5. Sign-in and access control

• Passwordless sign-in: one-time link and one-time code by e-mail, with an intermediate page that protects against e-mail scanners.
• Two-step verification (TOTP) is required for Brickstream’s accounts, for final reviewers and for customer users without company sign-in. The requirement is enforced in the database, not only in the interface.
• Row-level security in the database on all tables: a customer sees only its own organisation’s orders, and line managers see no prices.
• Sessions for Brickstream’s accounts and customer users end after at most 12 hours.

6. Encryption and secrets

All traffic uses TLS with HSTS. Data at rest is encrypted by the providers. API keys exist only as protected environment variables at the hosting provider, never in the code or in logs.

7. Logging

The security log cannot be altered afterwards: the database blocks changes and removals, and the rows are linked with a SHA-256 hash chain. Logged among other things: sign-ins, orders and declarations, uploaded files (name, size, checksum), every opening and download of material and deliveries, reviewer assignments and erasure. You may ask for an extract for your order.

8. Operations, monitoring and changes

Availability is checked every five minutes, and operations are followed daily. Every week the platform itself checks that its keys to the providers work, without anyone seeing the keys. The code is in a private repository; every change passes type checking, automated tests and a build before it is deployed, and database changes are additive. Operations, development and security checks are largely done by Brickstream’s AI team under the CEO’s responsibility and a written set of rules; the team may never relax security or permissions or handle secrets.

9. If something happens

If your material may have reached someone who should not have it, or another security problem has affected it, we tell you within 24 hours of discovering it: what happened, what is affected, what we have done and what we will do next. We stop processing the affected material until the cause is clear. If it concerns personal data in your material, you are told without undue delay so that you can notify the supervisory authority within 72 hours.

Report security issues to info@brickstream.se with the subject "Security" (see also /.well-known/security.txt).

10. Agreements

The terms for assignments (brickstream.se/villkor/uppdrag) include confidentiality and a data processing agreement (annex 1). If you want a separate signed DPA, the template is in this pack, and we sign a non-disclosure agreement on request.

11. Known limitations

Brickstream AB, reg. no. 556792-7644, Linköping, Sweden · Version 2026-10-16 · Contact: info@brickstream.se (subject "Security")

A template under Article 28(3) GDPR. The same content as annex 1 of the terms for assignments, which applies without a signature when you accept a quote. This template is used when your organisation wants a stand-alone, signed agreement. You may also use your own template.

Parties

Controller: [Organisation name], reg. no. [ ], hereinafter "the Customer".

Processor: Brickstream AB, reg. no. 556792-7644, Linköping, Sweden, e-mail info@brickstream.se, hereinafter "Brickstream".

1. Scope

This agreement applies when material the Customer sends to Brickstream in an order or a free sample contains personal data. It supplements the terms for assignments and the quote the Customer has accepted ("the Main Agreement"). In case of conflict this agreement prevails on matters of personal data.

2. Instructions

Brickstream processes the personal data only on the Customer’s documented instructions: the Main Agreement, the order and Annex 1. If Brickstream considers that an instruction infringes data protection rules, the Customer is informed without delay.

3. Confidentiality

Everyone at Brickstream with access to the data, including final reviewers, is bound by confidentiality or a non-disclosure agreement.

4. Security

Brickstream implements the technical and organisational measures described in the Security description (Annex 2) and required by Article 32.

5. Sub-processors

The Customer gives a general prior authorisation for the sub-processors in Annex 3. Brickstream informs the Customer at least 30 days before a change or addition, and the Customer may object on reasonable grounds. Brickstream imposes equivalent obligations on sub-processors and is responsible for their processing as for its own.

6. Transfers to third countries

Transfers outside the EU/EEA take place only with safeguards under Chapter V, for example the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework. Today AI processing takes place in the USA (Annex 3).

7. Assistance

Brickstream assists the Customer in responding to data subjects’ requests (Articles 12–22) and with security, impact assessments and prior consultation (Articles 32–36), taking into account the nature of the processing.

8. Personal data breaches

Brickstream notifies the Customer without undue delay and at the latest 24 hours after discovering a breach affecting the Customer’s data, with the information required by Article 33(3).

9. Audits

Brickstream makes available the information needed to demonstrate compliance and allows audits after reasonable notice, at most once a year except after a breach.

10. Erasure

Brickstream erases the material and the delivery 30 days after delivery and at once if the order is cancelled or declined; a free sample and its documents at the latest 30 days after the sample has been delivered or declined. Only data that must be kept by law (accounting records) remains.

11. Liability and term

Liability under the Main Agreement and Article 82. The agreement applies for as long as Brickstream processes personal data on the Customer’s behalf.

Annex 1 – The processing

Annex 2 – Security measures

The Security description, version 2026-10-16 (brickstream.se/sakerhetspaket).

Annex 3 – Sub-processors

The sub-processor list, version 2026-10-16 (brickstream.se/sakerhetspaket). For assignments and free samples: Supabase (storage, Stockholm), Vercel (web server, Stockholm), Anthropic PBC (AI processing, USA, standard contractual clauses) and final reviewers (Sweden, bound by reviewer agreements with the same obligations).

Place and date: ____________________

For the Customer: ____________________ For Brickstream AB: ____________________

Brickstream AB, reg. no. 556792-7644, Linköping, Sweden · Version 2026-10-16 · Contact: info@brickstream.se (subject "Security")

The list is the same as in the privacy notice (version 2026-10-23a). For assignments and free samples your material is processed only by Supabase (storage), Vercel (web server) and Anthropic (AI processing), and by the final reviewer in an order. Customers are notified of changes at least 30 days in advance.

Supabase Inc.

• What: Database, sign-in and file storage (CVs, contracts and invoices)
• Where: EU – AWS eu-north-1 (Stockholm); support access from third countries may occur
• Safeguards and agreements: DPA with standard contractual clauses for any third-country support access

Vercel Inc.

• What: Hosting of the web application (server functions), forwarding of the platform’s AI requests to Anthropic via Vercel AI Gateway and cookie-free visitor statistics for the public pages (Vercel Web Analytics)
• Where: EU – region arn1 (Stockholm) for server functions; global CDN for static files (no personal data); AI Gateway may process AI requests in the USA
• Safeguards and agreements: DPA, standard contractual clauses and EU–US Data Privacy Framework

Anthropic PBC

• What: AI reading of CVs (only if you opt in), client need texts, call-offs and purchase orders (only if the client approved) answers in the "Ask us" assistant when you ask a question (for signed-in users also the account data needed for the answer) and, in Bid rooms, the customer’s questions, the requirements review and the text of the customer’s files in the room and the knowledge bank (CVs, references, certificates, tender documents). Requests reach Anthropic via Vercel AI Gateway (Vercel Inc.) or directly via Anthropic’s API. Also Brickstream’s internal AI assistant (Claude) for operations, troubleshooting, development, support and e-mail
• Where: USA
• Safeguards and agreements: Platform AI requests and assignment deliveries: Vercel’s and Anthropic’s commercial terms with DPA and standard contractual clauses, model training blocked and only Anthropic allowed as provider. Brickstream’s internal AI assistant: Anthropic’s Claude Max terms, under which Anthropic is the controller and there is no DPA; training is switched off in the account settings, and the assistant only reads the data needed for the task and never customers’ material in assignments

Resend (Plus Five Five Inc.)

• What: Sending e-mail from the platform, sender info@brickstream.se: sign-in e-mails, notifications and invoices as PDF (name, e-mail address, message content and attachments)
• Where: EU region (Ireland) for sending; company in the USA
• Safeguards and agreements: DPA, standard contractual clauses and EU–US Data Privacy Framework

Zigned AB

• What: Electronic signing of agreements with BankID (name, e-mail, IP address, device information and the agreement content for the signer; with an identity check also the personal identity number, which Zigned hashes)
• Where: Sweden (company). Agreements and signatures are stored in the EU (Heroku and Google Cloud); e-mail delivery via Mailgun and some support (Typeform, Zapier, Slack) take place in the USA. The signed agreement and verification appendix are also stored by us (Supabase, Stockholm)
• Safeguards and agreements: Zigned’s data processing agreement (v1.0); transfers to the USA under the EU–US Data Privacy Framework or standard contractual clauses

Google (Google Workspace)

• What: Company e-mail at brickstream.se (including info@brickstream.se) when you write to us or we write to you, with any attachments. Our internal AI assistant may read and draft e-mails
• Where: EU and USA (Google data centres)
• Safeguards and agreements: Google’s Cloud Data Processing Addendum, standard contractual clauses and EU–US Data Privacy Framework

Cloudflare Inc.

• What: Bot protection (Cloudflare Turnstile) in the sign-in, sign-up, free-sample and enquiry forms: your IP address and technical signals from the browser and device (e.g. browser type, language and how the page runs) are assessed to decide whether a person is sending the form. No tracking cookies and no advertising; the form content is not sent to Cloudflare
• Where: Cloudflare’s global network (nearest data centre, normally in the EU); company in the USA
• Safeguards and agreements: Cloudflare’s DPA with standard contractual clauses and EU–US Data Privacy Framework

Wint AB

• What: Bookkeeping and accounting: client and self-invoices, payouts, receipts and vouchers (names, companies, amounts and invoice details)
• Where: Sweden/EU
• Safeguards and agreements: Data processing agreement (DPA) with Wint

Final reviewers

• What: review and correct the delivery in an order, in the platform with two-step sign-in, without being able to download the files.
• Where: Sweden.
• Safeguards and agreements: reviewer agreement with confidentiality and the same obligations as in the DPA; conflict-of-interest check before every assignment.