Security & privacy
Your specifications are confidential. We treat them that way.
Specification documents contain what your customers entrust to you. That's why ReqCompass is built for confidentiality from the ground up – from hosting to AI to data deletion.
| Vendor | German company: Sovarion Software GmbH, Rosenstraße 4, 35619 Braunfels, Germany. Contract, support and documentation in German and English, under German law. |
|---|---|
| Hosting (SaaS) | Three deployment options: SaaS in the Sovarion cloud (Microsoft Azure, region Germany West Central (Frankfurt), processing exclusively in the EU), deployment in your own cloud environment, or fully on-premises in your infrastructure. |
| GDPR | Data processing agreement (Art. 28 GDPR) and documented technical and organisational measures (Art. 32 GDPR). |
| AI processing | AI analysis via DeutschlandGPT or Azure (processing in Germany/the EU) or – on-premises – optionally via a local AI model. No provider uses your documents to train AI models. |
| Encryption | TLS 1.2+ for all connections, encryption at rest (AES-256). Tenant-separated data storage per customer. |
| Access & control | User management with roles and permissions in your hands. Our team has no access to your content in regular operation; support access only with your approval. |
| Backups & deletion (SaaS) | Daily automatic backups (retention 35 days), regular restore tests (SaaS only – Sovarion cloud). For your own cloud and on-premises deployments, you are responsible for data backup. After the contract ends: export of your requirements, assessments and comments as Excel/CSV, plus deletion in accordance with the data processing agreement. |
| Humans decide | AI suggestions are labelled as such and come with traceable reasoning – incl. source and similarity score. The decision on every requirement is always made by your team (human in the loop). |
Digital sovereignty
No dependence on US consumer AI: you determine where the software runs and which AI model it uses. With the on-premises edition, not a single byte leaves your company.
For your IT review
DPA, TOMs and answers to your security questionnaire are available before you sign – so your IT and data protection officer can approve without detours.
Open standards
Your data belongs to you: you export your requirements, assessments and comments yourself at any time as Excel or CSV – open formats, no data captivity.