Yours, and only yours.
Your data is the most valuable thing you hand us. These are the commitments we make about it, and they go into every agreement we sign.
Our commitments
In writing, not in a brochure.
Each of these is written into the agreements we sign with customers. If you would like to see the wording, ask us for the agreement.
- A private environment for each customer. Its own database, hosting and credentials. Nothing is shared or pooled between customers, so your data can never appear in someone else's report.
- Read-only connections. We read from your systems through official access, under your own accounts and keys. We do not write to them without your written approval for each specific change.
- You own your data. We process it on your behalf and for your purposes only. We do not sell it, share it, or use it for anyone else.
- Export at any time. All of your data, in standard formats, whenever you ask.
- Deletion when you leave. We delete your environment within 30 days of the end of our agreement, and confirm it in writing.
- Notice of any breach. If your data is ever exposed, we tell you within 72 hours of confirming it.
How we protect it
Security built into the way the work is done.
Access
Your team signs in with its own company accounts, and each person sees what their role allows. Access is enforced in the database itself, not only in the screens.
Encryption and secrets
Data is encrypted in transit and at rest. Credentials are kept in secure stores, never in source code, and we check our code history to make sure of it.
Backups and monitoring
Your database is backed up automatically every day. Every scheduled job records its runs, and a daily health check alerts us when anything is missing, late or failing.
Changes to your systems
Where you approve a write to one of your systems, it goes through a single controlled path that is logged, limited in rate, and tested without effect before it runs for real.
AI
Useful, labelled, and not learning from you.
We use AI to write summaries and to sort and classify information. We use only commercial AI services whose terms forbid training on the data we send them.
Anything written by AI is labelled as such in what we deliver. Each AI job has limits on volume and cost, and larger runs need a person to approve them.
Subprocessors
The services we build on.
These companies host or process customer data on our behalf. We give customers 30 days' notice before adding or changing one.
| Company | What it does for us | Where |
|---|---|---|
| Supabase | Database hosting, on Amazon Web Services | United States |
| Render | Application hosting | United States |
| GitHub | Source code and scheduled data jobs | United States |
| Anthropic | AI processing, with no training on customer data | United States |
| Sign-in with your company accounts | United States |
This website is served by Cloudflare. It sets no cookies and collects no personal information; see the privacy notice.
Questions about security?
Ask us anything about how we handle data. Write to hello@thabaiq.com, and we will answer plainly.