Anywhere

Security

Security & data protection

Anywhere runs on Amazon Web Services in the European Union. Customer data is encrypted by default, at rest and in transit, and every part of the platform gets only the access it needs to work.

  • EU

    All customer data is hosted on AWS in Frankfurt (eu-central-1).

  • AES-256

    Encryption at rest on every database, cache, volume and file store.

  • TLS 1.2+

    HTTPS everywhere, with HSTS and encrypted connections only.

  • 100% IaC

    Infrastructure defined as code in Terraform — reviewed, versioned and reproducible.

How your data flows

Users

Browser

Global edge (Amazon CloudFront)

HTTPS only · HSTS · strict security headers

Load balancer

Accepts traffic only from our edge

Private network · 3 availability zones · AWS Frankfurt (eu-central-1)

Application services

Serverless containers, no public IP addresses

Data tier

  • Application databaseAES-256
  • Document & AI database (vector search)AES-256
  • Cache & job queuesAES-256
  • Private document storageAES-256
AI processing
Amazon Bedrock — EU inference

Anthropic Claude, Cohere, Amazon Titan · inference stays within EU AWS regions

Azure Document Intelligence

OCR of scanned documents · only the content needed for extraction · under a signed DPA

Databases, caches and application containers are never directly reachable from the internet.

Security layers

Hosting & infrastructure

  • Single dedicated AWS account in the EU (Frankfurt).
  • All resources defined in Terraform, no manual console changes.
  • Serverless containers with provider-managed patching.

Network isolation

  • Dedicated private network across three availability zones.
  • Databases and application containers have no public IP addresses.
  • Each database accepts connections only from the service that owns it.

Edge & transport security

  • Every public endpoint behind Amazon CloudFront.
  • HTTP redirected to HTTPS, TLS 1.2 or newer, HSTS.
  • The load balancer accepts traffic only from our edge — direct requests are rejected.

Encryption

  • AES-256 at rest for databases, backups, cache, volumes and file storage.
  • TLS in transit, including internal cache connections; document storage rejects any request not made over TLS.
  • Keys managed by AWS KMS.

Identity & access

  • Every service runs under its own least-privilege role; no long-lived access keys in the platform.
  • Deployments use short-lived federated credentials, and only reviewed code from the protected main branch can be deployed.
  • Administrative access is keyless and audited, with no open inbound ports.

Secrets management

  • All credentials and API keys stored in AWS Secrets Manager.
  • Injected at runtime, never stored in code, images or configuration files.

Documents

  • Stored in private, encrypted storage, separated per service.
  • Accessed only through short-lived signed links.

Logging & monitoring

  • Structured logs from every service, network flow logs, load-balancer and CDN access logs, stored encrypted.
  • Health metrics and alarms in real time.

Backups & retention

  • Daily automated database backups with 7-day point-in-time recovery.
  • File storage versioned with 90-day history.
  • Logs retained on defined schedules.

Software supply chain

  • Automated build and deployment pipeline — no manual changes to production images.
  • Container images kept in our own private registry.
  • Every infrastructure change goes through reviewed, revertible Terraform history.

AI & your documents

  • Claude models run through Amazon Bedrock EU cross-region inference. Inference stays within EU AWS regions and on the AWS network.
  • Embeddings and reranking run in-region on Amazon Bedrock.
  • Scanned documents are processed by Azure Document Intelligence for text extraction — only the content required for extraction, under a signed Data Processing Agreement.
  • No other third-party AI providers sit in the request path.

AI prepares first drafts and summaries — the professional judgement stays with you.

Your documents

Inference stays within EU AWS regions

Amazon Bedrock — EU inference

Anthropic Claude · Cohere · Amazon Titan

Azure Document Intelligence

OCR of scanned documents · only the content needed for extraction · under a signed DPA

Where your data lives

Application database

What it contains
Accounts, cases, organisations, workflows
Protection
Encrypted, private network
Backups
Daily, 7-day point-in-time recovery

Document & AI database

What it contains
Documents, extracted text, embeddings for search
Protection
Encrypted, private network, AI services only
Backups
Daily, 7-day point-in-time recovery

Cache & job queues

What it contains
Sessions and background jobs (temporary)
Protection
Encrypted, TLS, authenticated
Backups
Temporary by design

Document storage

What it contains
Uploaded documents, transcriptions, generated files
Protection
Encrypted, TLS only, short-lived signed links
Backups
Versioned, 90-day history

Sub-processors

Amazon Web Services

Purpose
Hosting, compute, storage, databases, CDN, secrets
Location
EU · Frankfurt

Amazon Bedrock

Purpose
LLM inference, embeddings, reranking (Anthropic Claude, Cohere, Amazon Titan)
Location
EU cross-region inference

Microsoft Azure

Purpose
Azure Document Intelligence — OCR / text extraction
Location
Under a signed DPA

Each provider receives only the data required for its function. The current sub-processor list is available on request.

Security review or DPA?

We are happy to support your vendor due diligence. Ask us for the technical security overview, the current sub-processor list or a copy of our DPA.

info@anywhere.legal

Last updated: July 2026 — reflects the current production configuration.