Security & privacy
How Governli protects your vendor documentation
This page is maintained by the Governli team to answer common security and privacy questions about the platform. It describes practices and controls that are in place today, and is not a substitute for independent certification.
Data protection
- All uploaded documents are encrypted in transit using TLS.
- All uploaded documents are encrypted at rest.
- Customer data is never used to train AI models.
- Uploaded files are processed only for the requested assessment.
Data residency
- Primary database and file storage are hosted within the EU.
- Data processing locations are clearly identified on the Sub-processors page.
- EU-based sub-processors are prioritised wherever possible.
- AI analysis is a separate processing path: no EU residency is currently configured for it, and it may process data outside the EU/EEA under the safeguards described in the DPA.
Retention and deletion
- Documents and reports are retained for as long as your account is active, so assessments stay auditable.
- Deletion is performed on request: contact us and we remove the documents, reports and personal data you identify.
- Automatic, customer-configurable retention schedules are not yet available.
Compliance support
- Designed to support GDPR.
- Designed to support ISO/IEC 27001.
- Designed to support NIS2.
- Designed to support DORA.
- Aligns with internal governance frameworks.
Shared responsibility
Governli provides the platform, infrastructure controls and processing logic. Customers are responsible for the lawful collection of vendor documentation, for sharing only data appropriate to the assessment, and for reviewing the generated decision pack with their information security, legal and procurement stakeholders before relying on it.