Privacy Impact Assessment

1. Purpose of Processing

For the analysis of uploaded PDF documents (specifications / construction tenders), ISOCALCX uses the AI model Claude Sonnet 5.5 via the Anthropic API (Anthropic PBC, USA). The aim is to extract technical insulation positions (pipe insulation, fittings, valve covers, duct insulation, fire protection items). The chat/support assistant, photo evaluation (take-off) and price list import continue to use Claude models via AWS Bedrock (EU Frankfurt).

Processing steps

• Step 1 – Upload: User uploads a PDF (specification). Stored on servers in Switzerland (Infomaniak).
• Step 2 – Pre-filter (local): Server-side pre-filtering: only those pages and text sections containing insulation-relevant content are identified. Irrelevant pages (e.g. pure architectural plans, administrative texts, lists of persons) are NOT transmitted to the AI.
• Step 3 – Text extraction: Text is extracted from the pre-filtered pages (PyMuPDF / pdf-parse). Only technical text content is processed.
• Step 4 – AI analysis: The pre-filtered PDF extract (relevant pages only) is transmitted via the Anthropic API to Claude Sonnet 5.5 (Anthropic PBC, USA) for position extraction. The transfer is encrypted and based on the Standard Contractual Clauses (SCC) or a recognised adequacy framework.
• Step 5 – Post-processing: AI results are server-side filtered (false-positive filter, 17 steps), normalised and validated. Only plausible positions are stored.
• Step 6 – Pricing & review: Validated positions are matched against the company catalogue. The user reviews and corrects ALL results manually.

No automated individual decisions within the meaning of Art. 21 revFADP / Art. 22 GDPR are made – the AI serves exclusively as a suggestion system.

2. Data Minimisation (Pre-Filter)

Data minimisation is the central technical measure of ISOCALCX. We do not transmit the entire PDF to the AI but only the insulation-relevant part.

• Pre-filter (internal): Before each AI call, a deterministic pre-filter (keyword + regex + BKP context) runs. It identifies insulation-relevant pages and creates a reduced PDF containing only those pages. Personally identifiable attachments (e.g. address lists, architect directories, contact sheets) are typically filtered out before any data leaves Switzerland or reaches the AI.

Core principles

• Only relevant pages are forwarded (typically 30–60 % of the original PDF)
• Images, logos and plans are not specifically evaluated; since a PDF extract of the relevant pages is transmitted, graphics on those pages form part of the transmission
• No transmission of user account data, login information or pricing master data
• Sensitive fields (phone numbers, email addresses) are not actively evaluated

Data transmitted to the AI

• PDF extract of the pre-filtered relevant pages (technical descriptions, BKP numbers, material specifications, dimensions, quantities)
• For very large documents: split into several parts, each supplemented by context pages (preliminary remarks, section titles)
• Filename (for internal mapping)
• Technical analysis prompt (contains no user data)

Data NOT transmitted

• User personal data (name, email, address)
• Login or authentication data, passwords, JWT tokens
• Pricing master data or company catalogue
• Payment or subscription data
• Metadata of other users or tenants (strict multi-tenant isolation)
• PDF pages marked as irrelevant by the pre-filter

Caching

To avoid redundant API calls, analysis results are cached locally on the ISOCALCX server (Switzerland) (SHA-256 hash of the PDF as key). On re-analysis of the same document, the result is loaded from cache – without data leaving Switzerland again.

3. Legal Basis

The processing of document content by ISOCALCX and transmission to subprocessors is based on the following legal grounds:

• Art. 31(2)(a) revFADP – Performance of contract: The AI-supported analysis is a core component of the ISOCALCX service. The user agreement explicitly covers automatic PDF analysis.
• Art. 6(1)(b) GDPR – Performance of contract: For users from the EEA, performance of contract constitutes the legal basis under GDPR.
• Art. 19 revFADP / Art. 13 GDPR – Transparency: Users are informed about the use of AI and data transmission in the privacy policy, in this PIA and during registration.
• Art. 9 revFADP / Art. 28 GDPR – Processor: DPAs / data processing agreements are in place with the subprocessors; for Anthropic PBC, Anthropic’s commercial terms including its data processing terms apply.

4. Subprocessors

For the operation of the ISOCALCX platform, the following third-party providers act as processors. A data processing agreement pursuant to Art. 28 GDPR / Art. 9 revFADP is in place with the providers; for Anthropic PBC, Anthropic’s commercial terms including its data processing terms apply:

A detailed description of each subprocessor with links to their privacy notices is available in the Privacy Policy (Section 8).

5. Cross-Border Transfers

ISOCALCX designs the data flow so that third-country transfers are limited to what is necessary for the service:

• EU (AWS Bedrock Frankfurt): The chat/support assistant, photo evaluation (take-off) and price list import run on AWS servers in Frankfurt (eu-central-1). If that region fails, processing moves automatically to the second EU region Ireland (eu-west-1), so processing for these functions stays inside the EU in every case. A DPA with AWS pursuant to Art. 28 GDPR is in place; AWS Bedrock does not use transmitted data for model training.
• Switzerland (Infomaniak): All account, project, position and cache data are stored exclusively in Switzerland. The ISOCALCX database does not leave Switzerland.
• USA (Anthropic, Stripe): The AI evaluation of uploaded tenders/bills of quantities is carried out by Anthropic PBC in the USA; the pre-filtered PDF extract is transmitted for this purpose. Transmission to the USA may also occur for payment processing. The basis is the Standard Contractual Clauses (SCC, Art. 46 GDPR) or a recognised adequacy framework (e.g. the Swiss-US Data Privacy Framework, insofar as the recipient is certified). Transmissions are TLS-encrypted (TLS 1.2+).

6. Technical and Organisational Measures (TOMs)

The following TOMs are deployed to mitigate risks:

• Pre-filter as central TOM: The server-side pre-filter (see Section 2) is the most important measure for data minimisation. It typically reduces the data volume leaving Switzerland or reaching the AI by 40–70 %.
• Encryption: TLS 1.2+ for all transmissions (frontend ↔ backend ↔ AWS Bedrock / Anthropic). Argon2 for password hashing. SHA-256 for cache identification.
• Access control: JWT in HttpOnly cookies, RBAC (admin / company admin / user), strict multi-tenant isolation, API key rotation via key pool.
• Logging & monitoring: Structured Winston logging, internal error monitoring (anonymised), AI responses partially (first 2000 characters) logged for debugging – server and error logs are rotated and retained for 30 days at most; security logs of login events including IP address are deleted automatically after 30 days.
• Deletion routines: Temporary PDF uploads at AWS are removed after processing; AWS Bedrock does not store content persistently. At Anthropic, retention of the transmitted content is governed by Anthropic’s commercial terms. Users can fully delete their account and data at any time (immediate, 30-day grace period or anonymisation via SHA-256 hash). Deletion takes place in the productive systems; backup copies are not purged individually but expire no later than 30 days after they were created and are then overwritten. During that period they serve solely to restore service after a fault. If a backup has to be restored, the deletion is executed again immediately after the restore.

7. Risk Assessment

Identified data protection risks, residual likelihood after mitigation and measures taken:

8. Residual Risks and Honest Risk Communication

ISOCALCX deploys extensive technical and organisational measures. However, we openly communicate that no digital system can guarantee 100% security. The following residual risks remain:

• AI hallucinations: The language models used (Claude Sonnet 5.5 for PDF analysis, Claude models via AWS Bedrock for the other AI functions) are non-deterministic LLMs. Individual positions may be incorrectly extracted or fabricated. Final review lies with the user – the platform supports but does not replace specialist final control.
• US authority access (Schrems II): For the AI evaluation of tenders by Anthropic (USA), authority access under FISA 702 / CLOUD Act cannot be fully excluded legally, even where SCC or an adequacy framework apply.
• Provider model updates: AWS and Anthropic may update their models. ISOCALCX reviews model changes but cannot prevent behavioural changes.
• Pre-filter is heuristic: The pre-filter is rule-based. In individual cases, relevant pages may be missed or irrelevant pages forwarded. We minimise the risk but do not eliminate it.
• Endpoint security: Vulnerabilities on the user device (malware, compromised browser) are outside ISOCALCX’s sphere of control.

9. Assessment Result

This assessment is based on the following factors:

• Data type: Predominantly technical construction descriptions are processed. Personal data is included only marginally.
• Data minimisation: Pre-filter typically reduces transmitted data volume by 40–70 %.
• No automated decisions: AI results are suggestions; final approval by user.
• Contractual safeguards: Data processing agreements or data processing terms with all subprocessors; no use for model training (for Anthropic, in accordance with Anthropic’s commercial terms).
• Data hosting Switzerland: Account and project data are stored in Switzerland; for the AI evaluation, only the pre-filtered PDF extract is transmitted to Anthropic (USA).
• Data subject rights: Full deletion, anonymisation and data export available at any time.

10. Review and Update

This Privacy Impact Assessment is reviewed at least once a year and updated as needed in case of significant changes to the AI pipeline, models used or subprocessors.

Changes are published on this page. In case of substantial changes to the risk assessment, registered users are informed by email.

11. Contact

For questions about this Privacy Impact Assessment or data processing in connection with AI analysis, please contact: