Procurement Sciences

GDPR overview

GDPR is addressed concretely but from a US vantage point. EU residents are granted access, rectification, erasure, portability, restriction, objection and the right to lodge a complaint with a supervisory authority, all exercised through privacy@procurementsciences.com. Transfers out of the EEA or Switzerland are stated to rely on European Commission approved Model Contractual Clauses, and cookie consent is offered where local law requires it, with essential cookies excluded. A Data Processing Agreement is listed among the documents available on request. Two gaps are worth naming: no Article 27 EU representative is designated anywhere, and no DPO is named. All data is transferred to and processed in the United States, and the policy places responsibility for local data protection obligations on the non-US user.

Who owns the data?

The terms are explicit that Procurement Sciences owns the platform itself: all rights, title and interest in the Services, together with patents, copyrights, trademarks, trade secrets and know-how, remain with the vendor. Customer content sits on the other side of that line. Each deployment runs on a single-tenant architecture with dedicated storage, and the homepage states that customer data stays fully isolated within the customer environment and is never blended or commingled across deployments. The vendor does reserve the right to store customer data in line with its records retention policies. For personal data collected through the website, the privacy policy names PROCUREMENT SCIENCES, INC., 362 River St., Dunstable, MA 01827 USA as the controller.

Reuse rights

Customer material stays with the customer: the vendor states that data is never blended, commingled or used to train public AI models, and that outputs are grounded in the customer's own documents and knowledge base. Cloud AI services used behind the scenes, named as Azure OpenAI, Gemini on Vertex and Anthropic, run on zero data retention configurations, so prompts and responses are not stored, logged or reused for training by those providers. Nothing in the terms restricts what a customer may do with the proposals, matrices and analyses it generates. One caveat sits on the marketing side rather than the product side: the privacy policy acknowledges that categories of personal information collected through the website have been sold or shared with analytics and advertising partners in the past twelve months.

Data retention & training

Hosting summary

All storage and processing takes place in the United States. Three environments are offered: Azure Commercial Cloud in US-based Microsoft data centres; Azure Government Cloud in dedicated US Government regions running on FedRAMP High authorised infrastructure, compatible with CUI and GCC High; and customer-managed Kubernetes infrastructure for strict residency or air-gapped requirements, with an off-network option on fully isolated portable hardware. The architecture is single-tenant, with dedicated storage accounts, network segmentation and isolated compute preventing cross-tenant access. Data is encrypted with AES-256 at rest and TLS 1.2 or higher in transit, aligned with FIPS 140-2 validated modules. Web application firewall protection, DDoS mitigation and intrusion detection come from Azure-native services, and Azure Virtual Network configurations isolate customer traffic. Microsoft controls inherited include ISO 27001, ISO 27017, ISO 27018 and SOC 1/2/3. A product FAQ adds that data sits in Azure CONUS data centres inside a VPC/VNet, accessible only to US citizens employed by the vendor.