Data, Security & AI Compliance

What data Bite processes

Bite ingests structural engineering project files: analysis models (ETABS, SAFE), calculations, drawings (PDF, DWG), project correspondence (EML/MSG), and internal reports. We do not process personal data beyond user account details (name, email, organisation) unless your project correspondence names individuals.

GDPR (controller / processor)

Under UK and EU GDPR, you are the data controller for any personal data in your project f iles. Bite is the data processor. A Data Processing Agreement (DPA) compliant with UK GDPR Article 28 is available on request and sets out the liability allocation, sub-processor obligations, and breach notification commitments. EU Standard Contractual Clauses are in place where international transfers apply.

Incident response

In the event of a data incident, we comply with GDPR Article 33 (72-hour supervisory authority notification) and Article 34 (notification without undue delay to affected individuals where the risk is high). A documented incident response plan is being formalised internally (target: Q3 2026); in the interim, incidents are escalated immediately to the engineering lead and co-founders.

Building Safety Act 2022 / ISO 19650

Every file version and design change is recorded in an immutable, append-only commit log, and the log identifies who made each change and when. If a change needs to be rolled back, this does not remove the full audit trail that we store.

Data deletion

On request, all project data associated with your organisation (file blobs, database records, vector index entries) is deleted within 30 days. The audit trail itself is append-only for the duration of the contract.

Data residency

All customer data is stored and processed in Microsoft Azure UK South (London) by default. No data is transferred to other regions without explicit agreement. Azure UK South holds ISO 27001, ISO 27017, ISO 27018, SOC 2 Type II, and Cyber Essentials Plus certifications for the underlying infrastructure.

Tenant isolation

Cross-organisation data access is blocked today at the application layer via Clerk organisation IDs. As part of the current V1 build, isolation is being moved to PostgreSQL Row-Level Security for a database-layer enforcement boundary that holds independently of application logic. A separate-schema option is available for clients requiring physical isolation.

Secure file handling

Uploaded files are stored using content-addressed naming (SHA-256 hash as the blob key), which gives implicit integrity verification and prevents user-controlled paths in storage.

AI ethics & human oversight (accuracy of AI-surfaced information)

This was a specific concern raised at the meeting. Three points worth being explicit about:

• No hallucination on structural values. Bite’s retrieval pipeline returns extracted text from your source files, not AI-generated values. Numerical design values (loads, dimensions, material grades) are sourced from indexed files, not synthesised.
• Cited answers. Every search response includes source references (project, file, page) so engineers can verify the AI’s output against the original document.
• No autonomous design changes. AI agents propose change propagations and flag impact predictions. Every action requires explicit engineer approval before it is applied.

Business continuity & disaster recovery

Recovery Time Objective is 4 hours; Recovery Point Objective is 24 hours. PostgreSQL backups are retained for 35 days with point-in-time restore. Blob Storage uses geo-redundant storage replicating asynchronously to a secondary Azure region.

The applicable regulatory frameworks for our context are UK and EU GDPR, the Building Safety Act 2022 (for projects under its scope), ISO 19650, and the emerging EU AI Act. Our position on each:

GDPR

Bite operates as a data processor with a UK GDPR Article 28-compliant DPA. Sub-processors are listed in our full Trust & Security document and operate under equivalent data protection obligations. A Data Protection Officer appointment is planned for Q3 2026.

Building Safety Act 2022 / ISO 19650

As noted above, the immutable audit trail and version-controlled commit log are designed to support Gateway 2 submissions and ISO 19650 information-management requirements over the asset lifecycle.

How AI processing works (sub-processors and training data)

File content is sent to Anthropic Claude (extraction and summarisation) and OpenAI (vector embeddings) during ingestion. Neither provider retains submitted API data for training purposes under their API terms, and Bite does not use customer data to train or fine-tune any AI model. Search queries send only the query text and retrieved excerpts, not full file contents. Standard Contractual Clauses are in place for transfers to these providers.

AI ethics & human oversight (EU AI Act alignment)

Where the EU AI Act places obligations on high-risk AI systems around human oversight, transparency, and traceability, Bite’s design already reflects these principles: no autonomous design changes, cited answers traceable to source, immutable audit trail logging every AI-assisted action alongside the approving engineer, and no AI training on customer data. We will continue to track AI Act guidance as it is finalised and adjust as needed. Bite is also collaborating with a researcher at the University of Cambridge on a framework for AI ethics in structural engineering, to be submitted for publication in May 2026.

Compliance roadmap

Cyber Essentials is planned for Q4 2026. SOC 2 Type II and ISO 27001 are on the roadmap for 2027 onwards, with operational controls established during the current V1 build designed to be audit-ready.