This document describes what data Conormio stores, where it physically resides, who has access to it and who it is passed on to. It is written to describe the system as it actually is, not as it is intended to become.
1. What we store
Account data: name, e-mail address, language, hashed password, the time and IP address of the last sign-in, and the number of sign-ins.
Business data you enter yourself: companies, projects, work groups and positions, quantities and prices, norms, resources (workers, machines, materials), measurement sheets, situations, offers, invoices, daily logs and any documents you attach.
Technical data produced by the system: error reports and access records.
2. Where the data physically resides
Application and database: Heroku (Salesforce), region "eu" — AWS, Ireland.
Attached documents: Amazon S3, region eu-west-1 (Ireland).
Cache and real-time delivery: Redis Cloud, eu-west-1 (Ireland).
Error monitoring: Sentry, EU region (Germany), configured without personal data.
The only data that leaves the European Union is what you send to the AI features yourself (section 5) and outgoing e-mail (section 6).
3. How the data is protected
All traffic is over HTTPS (with HSTS). The database is encrypted at rest (AES-256) and database traffic runs over TLS.
Passwords are stored as a bcrypt hash (cost 12), with a minimum length of 10 characters. A session expires after 30 minutes of inactivity.
Sign-in, password reset and sign-up attempts are rate limited per IP address and per e-mail address.
Passwords, e-mail addresses and tokens are filtered out of system logs.
Two-factor authentication does not currently exist.
4. Who has access
Your company's data is accessible to your users only. One company never sees another company's data.
On our side, two named people have access to the production system. No external contractors have access.
We access your data only to fix a fault or at your request for support. Every opening of a screen belonging to a company we are not part of leaves a durable record — who, when, which screen and from which IP address — and those records are kept for 12 months.
5. AI features and Anthropic
The application has four features that use AI (Claude API, Anthropic, United States). Each one is started by an action of yours — nothing is sent on its own.
The bill-of-quantities import sends the whole document you attached. The invoice import sends the whole invoice. Position analysis sends the position name, unit, planned and verified quantities, and the unit price. The in-app help assistant sends the text of the question you typed.
Under its commercial terms, Anthropic does not use this data to train models. Their default retention is up to 30 days, after which it is deleted.
AI features can be switched off for your company. Note: switching off the AI import module does not today also switch off invoice recognition — separating that switch is planned and this page will be updated.
6. Who else the data reaches
Heroku (Salesforce) — application and database, AWS Ireland.
Amazon S3 via Bucketeer — attached documents, Ireland.
Redis Cloud — cache and real-time delivery, no durable business data, Ireland.
Sentry — technical errors, without personal data, Germany.
Anthropic — the content the AI features process, USA (section 5).
Namecheap Private Email — outgoing e-mail: welcome, password reset and employee invitation. No business data is sent by e-mail.
We do not sell your data, do not share it for marketing, and do not use it for anything other than providing the service to you.
7. How long we keep data
Business data is kept for as long as your account exists. Business records are not deleted by a shortcut — the system protects them from deletion, and archiving is the way out.
Questions asked of the in-app help are deleted after 90 days.
Records of our access to a company's data are deleted after 12 months.
The period for deleting data after termination will be set by the Terms of Service and the contract.
8. Your rights
You may ask what data we hold about you, ask for it to be corrected or deleted, and ask for a copy of your data. Send the request to the contact address at the foot of this page.
A note on format: today, export exists as PDF documents (offer, situation, measurement book). Export in a tabular format is being built.
Contact: info@conormio.com