openSales security: ISO certificates and data in Poland

When you choose a tool for working with tenders, more than just a convenient search engine or quick document analysis matters. You also want to know who is responsible for the service, how they protect information, and where they process the data.

openSales is backed by OpenNexus, a company holding four certificates covering information security, cloud service security, personal data protection, and business continuity.

These are standards that translate into how we organize our work: rules for handling information, team responsibility, risk management, and service development and maintenance. Additionally, we store and analyze tender documentation using AI in Poland.

What do ISO certificates mean for you?

Service security depends on both technology and the people who create and operate it. It is important who has access to the information, how changes are introduced, and what happens in case of operational disruption.

Certification gives you external confirmation that the company applies standards in a specific area. In the case of OpenNexus, the certificates were issued by TÜV NORD, and their scope covers the provision of cloud services supporting the electronic circulation of cases and procurement procedures.

They cover four complementary areas.

ISO/IEC 27001: information security management

This standard specifies the requirements for an information security management system. It includes risk identification, selection of safeguards, and regular assessment and improvement of data protection methods.

For you, this means that information security has defined rules, responsibilities, and supervision within the organization. The goal is to protect its confidentiality, integrity, and availability when needed. More about ISO/IEC 27001 (opens in a new tab).

ISO/IEC 27017: cloud service security

By using openSales through a browser, you are using a cloud service. ISO/IEC 27017 describes security practices related to the provision and use of such services.

This is an additional area of protection that takes into account the specifics of the cloud environment and responsibility for its security. More about ISO/IEC 27017 (opens in a new tab).

ISO/IEC 27018: protection of personal data in the cloud

Information processed in online services may include personal data. ISO/IEC 27018 focuses on its protection in public cloud services provided by processors.

For your company, this is an additional reference point when assessing a supplier to whom you entrust work with information. More about ISO/IEC 27018 (opens in a new tab).

ISO 22301: business continuity management

In tender work, timing matters. Therefore, besides information security, the organization's ability to respond to disruptions and restore operations is important.

ISO 22301 concerns business continuity management: preparing the organization for difficult situations, limiting their effects, and restoring necessary processes. This is a standard particularly relevant for a service provider whose services you use in your daily work. More about ISO 22301 (opens in a new tab).

Procedures that translate into daily work

The rigor of certification lies in the fact that the organization must demonstrate how it applies the requirements covered by the certificate. Documented rules, assigned responsibility, and the ability to assess whether the adopted system works are required.

Our certification is also subject to surveillance during its validity period. Maintaining standards therefore requires continuous work.

At OpenNexus, we also take security principles into account when developing and maintaining software. The way work is organized, the handling of information, and the assessment of risks associated with changes are important.

Procedures and policies organize work within the company. Terms and conditions specify the rules for using services and the responsibilities of the parties. Together, they help to clearly establish who is responsible for a given area and how to proceed.

Certification does not mean that risk disappears completely. It confirms, however, an organized approach to limiting and managing it.

Documentation and AI analysis remain in Poland

The place where data is processed is a separate issue from certification.

We store tender documentation in Poland. It is also processed in Poland for the purpose of AI analysis in openSales. Documents are not sent outside Poland for this purpose, as happens when you use analysis via, for example, ChatGPT, which sends your documents and questions to servers outside the EU.

This applies to both the preparation of summaries and the analysis of information contained in attachments.

This means that when assessing openSales as a tool for your company, you receive specific information about the place where the documentation is processed. We indicate the country, Poland, instead of stopping at the general description 'within the EEA'.

This may be important for internal supplier assessment, data localization requirements, or a conversation with the person responsible for security in your organization.

Four OpenNexus Certificates

We hold certificates covering the following standards:

By choosing openSales, you can assess both the functions needed for working with tenders, as well as the standards of the organisation providing them: audited security management, preparedness for disruptions, and a clearly defined location for document processing and AI analysis.

See how tender document analysis with AI works and how to check answers.