Security and data protection.
WonMetrics is operated by AddonNordic ApS, a Danish company registered under CVR 46495985. Your tracking data and your account are processed and stored inside the EU; one hosting region is still being confirmed in the provider’s settings, and the subprocessors page says which. The other exception is email delivery, and we say so rather than rounding it off: our email provider sends from EU infrastructure but keeps its logs in the United States, under standard contractual clauses. It is listed at /subprocessors like everything else.
The data we hold is public contract-award notices, public registry information about companies, and your own account details — we do not ingest your customer database or your bid pipeline, and we do not ask you to upload either.
This page is written for the person who has to approve a supplier. It says what we do, and it names the things we have deliberately not claimed.
What we store
Three things, and nothing else:
- The list of competitors you track — country and registration number, plus a label if you set one.
- The awards and dossiers behind your alerts — award notices from TED and Doffin naming a tracked company as winner, and what the registers published about it: identity, financials where the register publishes them, ownership where legally available, and official risk flags such as insolvency or liquidation — each with the date it was recorded and a link to the source.
- Your account — the email address you sign in with, your plan, and your usage against it.
Company officers are named people, so registry data is personal data even though it is public. We treat it that way rather than pretending that “it was already public” settles the question.
Where it runs
The dashboard at platform.wonmetrics.com runs on Lovable Cloud with a managed Supabase project for its database and authentication; the hosting region is EU, to be confirmed in the provider’s settings, and recorded at /subprocessors. The company data behind the dossiers comes from the Nordic Data API — our own first-party service — hosted on Railway in the EU-West region. WonMetrics keeps its own database rather than sharing one with our other products, so your tracking data is not co-mingled with another service’s tenants.
Registry lookups are made server-side. The credentials that reach the upstream registries exist only on our backend — they are never present in the browser, in a mobile app, or in any client bundle. There is exactly one code path that talks to the upstream data service, which is what makes that statement checkable rather than aspirational.
Access and authentication
You sign in with an email address and password held by our authentication provider; we never see or store your password. Every request to the API carries your session token, and the account it resolves to determines which data you can read. An account can only ever see its own tracked companies — the check is applied on the server for every request, not chosen by the client.
Lawful basis
Our position, stated plainly so you can assess it rather than take it on trust: we process public registry data — including the names of company officers and, where a register makes it available, beneficial owners — on the basis of legitimate interests, namely enabling businesses that bid for public contracts to see who wins them and who they are competing against. Public scrutiny of business activity is the same basis on which the registers themselves publish the information.
Where a register restricts access — as the beneficial ownership registers in Ireland, the Netherlands and Germany now do — we do not seek a way around it. We publish those gaps on the coverage page instead.
You act as controller for the competitors you choose to track; we act as processor for that activity. A data processing agreement is available at /dpa.
Subprocessors
We use a small number of third parties to run the service — hosting, database, authentication, payment and email. Each one is listed at /subprocessors with what it does and where it processes data. That page is the authoritative list; if it is not on that page, it does not touch your data.
What we do not claim
Security pages usually list certifications. Ours does not, because we do not hold any, and a page that implies otherwise is the first thing a serious reviewer catches.
- No ISO 27001 or SOC 2. We are a small company and have not been audited against either.
- No uptime guarantee. We do not publish an availability figure we have not measured over a meaningful period, and we do not offer an SLA today.
- No penetration test to show you. When there is one, it will be named here with its date.
If your procurement process requires any of these, tell us before you buy rather than after. We would rather lose the deal honestly than pass a questionnaire we should have failed.
Reporting a vulnerability
Write to contact@addonnordic.dk with enough detail to reproduce the issue. A person reads it. We will confirm receipt, tell you what we found, and let you know when it is fixed. We do not run a bounty programme and we will not threaten you for reporting something in good faith.
Getting your data out, or deleted
Your tracked-competitor list is visible in the product at all times, and you can ask us for a copy of the account data we hold about you. If you close your account, we delete the personal data we processed on your behalf within 30 days, except where the law requires us to keep something — invoicing records, for example.
Questions from procurement.
Where is our data processed?
In the EU. WonMetrics is operated by AddonNordic ApS, a Danish company registered under CVR 46495985. The Nordic Data API behind the dossiers runs on Railway EU-West; the application platform’s hosting region is EU, with final confirmation pending in the provider’s settings, and each provider’s location is recorded at /subprocessors.
Do you have ISO 27001 or SOC 2?
No. We hold no security certifications and do not imply otherwise. If your process requires one, we are not a fit yet, and it is better for both of us to know that early.
Are we the controller or the processor?
You are the controller for the competitors you choose to track; we act as processor for that activity. A data processing agreement is available at /dpa.
Who are your subprocessors?
They are listed at /subprocessors, with what each one does and where it processes data. That list is authoritative — nothing outside it touches your data.
Does WonMetrics see our customer database?
No. You add the competitors you want to track, by registration number or name. There is no import of your CRM, your ledger or your contact records, and we do not ask for one.
Can we get our data if we leave?
Your tracked-competitor list is visible in the product throughout, and you can ask us for a copy of your account data at any time. We do not hold your data as leverage at renewal.