Skip to content

Security at Jonty

Your bids stay yours

Your pipeline, tender packs and pricing are stored in the UK, encrypted in transit and at rest, and never used to train AI models.

For the full list and our data processing terms, visit the Trust Center (opens in a new tab).

Questions? Email jonty@askjonty.ai.

How we earn it

No badge-waving. These are the practices built into Jonty from day one, each one verifiable in how the product behaves.

  • Your data stays yours

    We never use your data to train AI models. We never sell it or share it with marketers, advertisers or data brokers. Your bid intelligence stays private and under your control.

  • Stored in the UK

    Jonty runs on AWS in London. Your records, tender documents, recordings and backups all live in the UK. The AI that reads your documents and builds your search index runs in the EU, asserted in code, and never trains on your data. Only if you ask for it does AI scoring outside the UK read your Vault pages.

  • Encrypted by default

    Your data is encrypted in transit with TLS and at rest with AES-256. Your documents are sealed under your company's own encryption key. The text and search index we derive from them live in our encrypted UK database and are deleted with your account.

  • Isolated by design

    Every query is scoped to your company in our application, and your documents are encrypted under your company's own key.

  • Scanned before it's stored

    Every tender pack and Vault upload is held back and scanned for malware before we use it. Infected files are deleted and reported to you. Office files, PDFs and scanned images are read inside a single-use sandbox with no internet access, then discarded. Previews render in our own viewer; we never hand your documents to third-party viewing services.

  • Locked down by default

    Our databases and internal services sit on private networks with no public access. Credentials live in a managed secrets store, never in code. Card details never touch our servers; Stripe handles payment.

The detail, for your due diligence

The specifics most security questionnaires ask about, answered up front.

  • Data residency

    • Our servers, databases and document storage run in the AWS London region. Your data is stored in the UK.
    • The AI that reads your documents and builds your search index runs in the EU, asserted in code, and never trains on your data. The one exception is AI scoring of your Vault pages, which runs only if you ask for it (below).
    • Dictation audio is transcribed on our own servers and never sent to a third party.
    • Some providers operate outside the UK, for example for live voice on your onboarding call, for AI matching and for AI scoring. AI matching reads your business profile and public tender notices. AI scoring receives your business profile with names and contact details removed, and it sees none of your documents. Only if you ask us to switch it on, it also scores which pages of your Vault answer a question, and then sees the question and the text of those pages, with the same details removed.
    • Our Trust Center, which we share with customers and prospects on request, lists every provider that processes your data, where it does so and the safeguard for each transfer.

  • Encryption

    • TLS on every connection between you and Jonty, and encrypted connections to our databases.
    • AES-256 encryption at rest across databases and document storage.
    • Your documents are sealed under your company's own encryption key. The text and search index we derive from them live in our encrypted UK database and are deleted with your account.

  • Access control

    • Every request is scoped to your company.
    • The Claude connector (MCP) is read-only and secured with OAuth 2.1. You can revoke its access at any time.
    • Production access is limited to a small number of named people. Credentials live in a managed secrets store, never in code or config files.

  • Uploads and documents

    • Every tender pack and Vault upload is held back and scanned for malware before we use it. Infected files are deleted and reported to you.
    • Office files, PDFs and scanned images are read inside a single-use sandbox with no internet access, then discarded.
    • Anything that fails or skips scanning is purged automatically.
    • Documents preview in a viewer we bundle and run ourselves. Your documents are never sent to third-party viewing services.

  • Retention and deletion

    • Onboarding call recordings are deleted automatically after 30 days (see our Recording Policy).
    • Close your account and your data is deleted within 30 days, except records we are legally required to keep.
    • Databases run with deletion protection and automated daily backups.

  • Payments

    • Checkout happens on Stripe, not on our servers. We store your customer ID, plan and subscription status, never card numbers.

Certifications, honestly

We do not yet hold ISO 27001 or Cyber Essentials. Rather than wave a badge, we have written down what we do. Formal certification will come as we grow. If your due diligence needs more than this page, email us for access to our Trust Center, or with your questions, and we will answer, usually the same day.

Ask us anything

Security questionnaires, data processing agreements, or anything this page left you wondering about. Email jonty@askjonty.ai and we will reply.

Found a vulnerability? Tell us at the same address. We are grateful for responsible disclosure and will respond quickly.

See also our Privacy Policy and Recording Policy.