AI Quoting Software Security: A Checklist for IT and Procurement

As of 13 Nov 2026. Resource type: checklist (template). Not legal advice: the legal sources are linked, and you agree the details with your data protection officer. Statements about Scalera come from the official FAQ.

Why tender data deserves special protection

A bill of quantities looks technical. Together with your quote, though, it holds exactly what competitors would like to see: your unit prices, discounts, alternative products and the projects you are working on.

On top of that comes personal data. Requests name planners, buyers and site managers with phone numbers and email addresses. How such requests arrive in the inbox is covered in tender requests from the email inbox.

So two protection goals apply at once: trade secrets and data protection. For personal data, Art. 32 GDPR and Art. 8 FADP require security appropriate to the risk. Prices and calculations carry no such legal duty, but the same interest.

Don't check what a vendor promises. Check what it can prove in writing.

Block 1: Contract and roles

This is where you settle who is responsible for what and what the vendor may do with your data.

The sub-processor list is a central annex: it shows whether an external AI service sees your tenders.

Block 2: Data location and transfers

For AI, the location of the data centre alone is not enough, because the model can run somewhere other than the database.

Swiss companies also check whether the Federal Council has found the target country to offer adequate protection (Art. 16(1) FADP).

Block 3: AI training and outputs

This block separates AI software from ordinary cloud software. Ask each question on its own, because «we don't train on your data» can mean three different things.

If the system learns from matches you confirm, that can be intended. What matters is that this knowledge serves only your account.

How product matches with reasoning and confidence are created is described on the product matching page. For the security review, what counts is where this data sits and who can see it.

Block 4: Technical security

Art. 32(1) GDPR names four measures explicitly. Ask about each one and have the vendor show you how it is implemented.

For certificates the full reference counts, for example «ISO/IEC 27001:2022», as ISO itself recommends.

ISO/IEC 27001 sets requirements for an information security management system (ISO). ISO/IEC 27018 adds guidelines for cloud providers that process personal data on behalf of customers. Ask whether a certificate covers the vendor itself or its data centre. Both are legitimate, but they are not the same.

Block 5: Incidents, deletion and exit

After a personal data breach, the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours (Art. 33 GDPR). In Switzerland the rule is «as soon as possible» where a high risk is likely (Art. 24 FADP). For that you need to hear from the vendor in time.

A clear exit lowers the risk of an implementation: you know beforehand how to get out again.

How to use the checklist

1. Send it before the pilot. Include the 20 checks or the questionnaire below in your first request to the vendor, not after the test.
2. Ask for evidence. A clause, list or document for every point. Without evidence, the point stays open.
3. Use a traffic light. Green with evidence, amber with a commitment, red for a no or no answer.
4. Decide together. IT, data protection and procurement sign off the result. Red points in block 1 or 3 stop the pilot.
5. Then test the functions. Only after that do you test features with real tenders, for example with the selection checklist in our guide.

Questionnaire to copy

You can paste these questions straight into an email to the vendor. Ask for evidence with every answer.

1. Please send your data processing agreement (DPA) and the list of all sub-processors, including the AI model.
2. In which countries are our data, backups and the AI model's processing located?
3. Is our data used for public models, for other customers, or only for our account?
4. How long do you keep inputs, outputs and logs, and how do we delete them?
5. How is data encrypted in transit and at rest?
6. How do you grant and review access rights, internally and on our side?
7. Which certificates do you hold, what do they cover, which edition, and until when?
8. Within what time do you inform us of a security incident, and whom?
9. How do we export our data, and how do you confirm deletion at contract end?

How Scalera answers these points

For context, using only what the official FAQ states:

• Data location: data is stored in European data centres.
• AI training: Scalera uses private AI instances. Your data is never used to train public LLMs, and there is no cross-customer AI training.
• Encryption: protected in transit via TLS and in the cloud through end-to-end encryption.
• Access: least-privilege principle, access permissions adjusted regularly, cloud environments monitored with cloud security posture management.
• Certificates: servers certified to DIN ISO/IEC 27001 and 27018.
• Contract: Scalera can provide detailed information about its data processing agreements and infrastructure.

Anything not listed there is best asked directly. The ERP integration is a separate topic with its own interface questions. You can book a call via request a demo.

Frequently asked questions

Do I need a data processing agreement for AI quoting software?

Yes, as soon as the vendor processes personal data on your behalf, for example names and email addresses of contacts in requests and bills of quantities. The GDPR requires a contract under Art. 28; in Switzerland, Art. 9 FADP covers processing by processors.

Is my tender data used to train the AI?

That depends on the vendor, so put it in writing in the contract. Ask separately about public models, other customers and your own account. According to its FAQ, Scalera uses private AI instances, your data is never used to train public LLMs, and there is no cross-customer AI training.

Is an ISO 27001 certificate enough proof?

It is a strong element, but it does not replace the other checks. Ask to see the certificate and check the issuer, the edition and the validity. ISO recommends citing certification with the full reference, for example «ISO/IEC 27001:2022» (ISO). Also ask whether it covers the vendor itself or its data centre.

May tender data be processed outside the EU or Switzerland?

Only under conditions. The GDPR governs transfers to third countries in Articles 44 ff., the FADP covers disclosure abroad in Art. 16. So ask not only where the data centre is, but also where the AI model and every sub-processor run.

Who should fill in the checklist?

Ideally three roles together: IT for technology and access, data protection for contract and transfers, procurement or sales management for exit and operations. Nobody checks alone, and open points surface before the pilot.

Where do I find criteria for the functional selection?

This checklist covers data security only. Criteria such as BoQ import, product matching, formats and a pilot with real tenders are in the selection checklist in our proposal automation guide.