Security and trust

Updated 22 October 2026

This page is for the people who have to approve Real Assets inside a company. It says what we do today, in plain words, and where we have not done something yet. For anything not covered, write to hello@analystai.ai.

Where the data lives

Accounts, billing status, saved chats and our own data are in a database on our own server, hosted by Hetzner in Germany.
The website is served by Vercel. Requests to our servers pass through Cloudflare.
The public reports and filings behind the Library are stored once in Cloudflare R2, a store for public documents only. No customer data is kept there.
We do not store card numbers. Payments are taken by Stripe.
Customer file uploads are not open yet. Before they open, the design is: each account's files in a private store of their own, separate from the public documents, with the code refusing to read a file outside the account's own folder.

Your data is yours

A file you upload, and every fact read from it, is yours and confidential. We do not use it for our own benefit in any way: not in our database, counts, analysis, benchmarks or tests, not to train or tune anything, and we never show it to anyone else. It is never merged into our own data. This is written into our terms.

Encryption

The website and our servers are reached over HTTPS only. A request made over plain HTTP is sent on to HTTPS.
Our database accepts encrypted (TLS) connections only.
Database backups are encrypted, and have been since 12 October 2026.

Access control

Customers have no passwords to steal. You sign in with a single-use emailed link and code, or with Google or Microsoft. A code stops working after five wrong tries.
A session is a signed token that expires after 30 days, and we can cancel it at any time.
What a person can open is checked on our server each time, against their subscription and seat. A seat is one named person.
Saved chats and answers are read only for the signed-in person who owns them.
Administrative functions need a separate operator credential, not a customer sign-in.
Logging in to our servers is by key only. Password login and root login are off.
Our credentials are kept in a managed secret store, not in our code.

Abuse protection

A bot check on sign-up, limits on how many sign-in emails one address or one person can ask for, and a limit on requests per minute.
Analytics and error reports are cut before they leave your browser: no questions or answers, no email address, and nothing after the question mark of a page address. Tests in our code hold this in place.

Backups

Every database is backed up once a day and copied off the server to separate storage at Cloudflare.
We keep the newest 14 daily copies and 4 weekly ones.

Incidents and reporting a weakness

Email hello@analystai.ai with the subject "Security". Include what you saw and how to reproduce it.
If an incident affects your data, we tell the affected customers within 72 hours of confirming the incident.

Who else handles data

These are the outside services that receive data from the product, and what each receives. The same list is on the privacy page.

Service	What it does	What it receives
Stripe	Takes payments and runs subscriptions, invoices and the billing portal.	Your email address and name, billing address, tax number if you give one, the market and seats you buy, and your card details, which you type into Stripe and we never see.
Resend	Sends the emails: sign-in links and codes, the welcome email, notices and digests you asked for.	Your email address, your name if you gave one, and the text of each email.
Cloudflare	Checks that a sign-up is not a bot, sits in front of our servers to filter traffic, and stores the public reports and filings in the Library (public documents only, never customer data).	Your IP address and browser details when you load the bot check or any page of the service; the requests you make to our servers pass through it.
Vercel	Hosts the website and counts visits without cookies.	Your IP address, the page asked for and basic browser details. Page counts are kept without cookies.
Hetzner	Hosts our servers and database in Germany.	Everything we keep: accounts, billing status, saved chats and answers, and our data.
OpenRouter	Passes your question to the AI models that write the answers.	Your question, the recent turns of that conversation and the facts we retrieved to answer it. Not your email address or name.
Cerebras, Groq and Google (fast answers)	Where we switch on faster answering, they write the answer in place of the service above.	The same as the row above: the question, the recent turns and the retrieved facts.
Google (live voice briefing)	Runs the live voice briefing, where you talk to the analyst.	What you say or type in the briefing, and the data lookups made to answer it.
PostHog (United States)	Product analytics and screen recording, with all text and inputs hidden before anything leaves your browser.	Page views, which buttons are used, and an internal account number. Never your email address, name, questions or answers. Only after you agree, where the law asks for it.
Sentry (United States)	Error reports, so we can fix what breaks.	The error, the page address without anything after the question mark, the version of the site and your account number. Only after you agree, where the law asks for it.
Google and Microsoft sign-in	Let you sign in with your Google or Microsoft account, only if you choose to.	Your sign-in with them. We receive your email address, your name and their account identifier.
Mapbox and Esri	Supply the map tiles and satellite pictures behind our maps.	Your IP address and the map area your browser asks for.
deck-engine (our own service)	Collects the market news we show, and is our service for reading public documents.	The market and search terms for news. It receives no account, email address or name of any customer.

Our secret store holds our own credentials and no customer data. We add a service to this list before we start sending it anything that identifies a customer.

Questionnaire answer sheet

Short answers to the questions security reviews ask most. A plain "not yet" means we have not done it.

Question	Answer
Where is customer data hosted?	A server at Hetzner in Germany. The website is served by Vercel.
Is data encrypted in transit?	Yes. HTTPS for the site and the servers, TLS for the database.
Is data encrypted at rest?	Backups: yes. For the live database disk we have not yet confirmed it, so we do not claim it.
How do users sign in? Do you support single sign-on?	Emailed single-use link and code, Google, or Microsoft. SAML single sign-on is not offered.
Is multi-factor authentication available?	Not as a separate setting. There are no customer passwords, and every sign-in needs a single-use link or code, or a Google or Microsoft account.
Can we manage our own users?	Yes. The account owner invites and removes named seats from the account page.
Do you use customer uploads to train models or improve your data?	No. Never, in any form. See the terms.
Is one customer's data separated from another's?	Yes. Saved chats and answers are read only with the owner's account. Uploads, when they open, are kept per account.
Do you keep backups?	Yes. Daily, encrypted, copied off the server. 14 daily and 4 weekly copies are kept.
Have you tested a full restore of this product's database?	Not yet.
How long do you keep data?	Saved chats stay in your account history. When a seat is removed, that person's chats and saved answers are kept for 90 days and then removed. Screen recordings (where you agree to them) are kept for 30 days.
Can you delete our data on request?	Yes. Email hello@analystai.ai from the account's address.
Who are your subprocessors?	Listed above.
Do you hold a SOC 2 or ISO 27001 certificate?	No.
Has an independent party penetration tested the product?	Not yet.
Do you have a data processing agreement?	We have not published a standard one yet. Write to hello@analystai.ai if you need one.
Who do we contact about a security issue?	hello@analystai.ai, subject "Security".
Do you store payment card numbers?	No. Stripe handles them.