Because trust is the best foundation
At Buildsimple, security is not an add-on. It is part of who we are.
Procurement, IT, data protection and compliance teams need clear and reliable information. That is why we provide the most important evidence and framework conditions in a transparent and concise format. This allows you to assess more quickly whether Buildsimple meets your security and compliance requirements.
Trust begins with transparency
ISO/IEC 27001
Customers who are themselves subject to regulatory requirements are obliged to assess and monitor the security of their service providers. Buildsimple supports this assessment through ISO 27001 certification as external, independently audited evidence.
BSI C3A
With the Criteria enabling Cloud Computing Autonomy (C3A), the German Federal Office for Information Security (BSI) has presented a forward-looking framework that makes the sovereignty characteristics of cloud services transparent. Buildsimple has summarized the implementation of the criteria in a position paper for interested parties.
AWS Qualified Software
Passing the "AWS Foundational Technical Review" (FTR) confirms that the Buildsimple platform meets AWS's high standards for security, reliability and operational excellence.
Hiroshima AI Process
When using AI in document-based processes, you need more than good recognition results. You need to be able to understand how risks are assessed, models are tested and results are controlled.
Buildsimple follows the Hiroshima AI Process (HAIP) and documents its own approach to AI risks, information security, governance and human-in-the-loop. This gives you greater confidence when introducing and operating AI in production—especially when processes must remain auditable, traceable and compliant.
Data location & infrastructure
Buildsimple is operated in one of the most secure public cloud infrastructures at Amazon Web Services (AWS). For European customers, operations take place in Frankfurt am Main (eu-central-1) or in the European Sovereign Cloud in Brandenburg. For data that may not be processed in a public cloud, Buildsimple-EDGE offers you the option of processing it in your own data center.
Data processing
For your security, all data at Buildsimple is processed and stored exclusively in encrypted form.
HTTPS with TLSv1.3
AES-256
Client-side encryption
Bring your own key
Tenant isolation
Anonymization
Immediate deletion after processing
Security & governance in production operations
Our security does not end with the infrastructure. Production AI processes require controllable changes, traceable versions and clear responsibilities. Buildsimple supports this, among other things, through:
Versioning and staging
Monitoring and traceability
Logging and audits
Roles and permissions
Stable APIs and exception handling
Human-in-the-loop, where professionally or regulatorily required
Deletion
After the end of the contract or upon deregistration, information is deleted in accordance with the agreement.
Sub-processors
Amazon Web Services EMEA SARL
38 avenue John F. Kennedy
L-1855 Luxembourg
Service: Provision of cloud infrastructure / services
Initiative & network
Buildsimple participates in the Cloud Services Made in Germany initiative. The aim of this initiative, launched in 2010, is to ensure greater legal certainty when using cloud services.
With the Alliance for Cyber Security, the German Federal Office for Information Security (BSI) aims to strengthen Germany's resilience to cyberattacks. We are a partner of the Alliance for Cyber Security and share our expertise with the network
Would you like to assess the use of Buildsimple against your security & compliance requirements?
We will be happy to provide you with the relevant information for security, data protection and procurement reviews in a concise format.
Regulatory requirements
GDPR / BDSG
Compliance with the General Data Protection Regulation has been mandatory for all European companies since 2018. Buildsimple meets these obligations through comprehensive technical and organizational measures. These include, among other things, a privacy-by-design concept, anonymization, data minimization, roles and access rights, logging, as well as comprehensive deletion and retention standards.
EU AI Act (AI governance)
Risk and quality management, human-in-the-loop, traceable decisions through logging and audit trails, as well as transparency regarding model and configuration states are supported by controlled approvals through versioning and staging.
DORA (operational resilience—financial sector)
Buildsimple supports third-party risk management through robust security evidence, operational and recovery concepts, incident processes, monitoring, and traceable changes through change and release controls.
Cyber Resilience Act (product cybersecurity)
Secure-by-design development principles, vulnerability management, patch and update capabilities, as well as a clear approach to security findings throughout the product lifecycle contribute to future product cybersecurity requirements.
EU Data Act (data access & portability)
Export and interface capabilities, clear data and metadata structures, and support for migration and exit scenarios help avoid vendor lock-ins and make data portability practical.
NIS-2 / Digital Services Act
Reporting obligations and governance mechanisms within the meaning of NIS-2 and the DSA are supported and contractually guaranteed by Buildsimple.
Contact
Assess Buildsimple based on the questions that matter for your approval
Data protection, information security, the operating model, traceability and controlled changes must be clearly clarified before productive use. We provide you with the relevant evidence and information for your assessment and explain how data processing, versioning, approvals, audit trails and responsibilities are governed at Buildsimple.
FREQUENTLY ASKED QUESTIONS
FAQ
What evidence is needed for a sound decision?
When processing sensitive documents, specific technical, organizational and contractual evidence is essential. Here, we answer questions about data processing, encryption, permissions, deletion, AI governance and regulatory requirements.
For European customers, the platform is operated in German AWS Regions. Depending on the requirements, additional operating models can be assessed, including the AWS European Sovereign Cloud or Buildsimple Edge.
According to the current approval template, Buildsimple is certified in accordance with ISO/IEC 27001. Further technical, organizational, and contractual evidence can be provided for security, data protection, and procurement reviews.
Data is encrypted in transit and at rest. The specific configuration, key management, and possible options such as Bring Your Own Key are documented as part of the technical and contractual review.
Versioning, staging, monitoring, logging, roles, permissions, and human-in-the-loop support controlled changes and traceable processing. This makes it possible to document model and configuration states as well as relevant processing steps.
Storage and deletion periods are defined depending on the process and contractual agreement. Where possible, documents can be deleted after processing. The specific deletion logic must be documented in the relevant customer context.
Buildsimple provides technical and organizational building blocks that support governance, traceability, monitoring, human-in-the-loop, and third-party assessment. The legal assessment and classification of the specific use case remain the responsibility of the respective company and its competent bodies.