Security and data protection

The natural-language features are powered by two AI providers: OpenAI for Standard analysis and Anthropic's Claude for Deep analysis. If one is unavailable, the other answers, so either can receive any question. Both receive exactly the same information. For each question we send a statistical description of the relevant dataset:

• column names and data types
• row counts and how many values are missing in each column
• averages, standard deviations, minimums and maximums
• the most common values of ordinary category columns, such as Province or Product Line, unless you have withheld them
• your question, and the recent turns of the conversation

We do not send rows, files, samples of your records, or the values of any column that looks like an identifier. When a question needs a specific figure, our own code computes it from your data and the model is asked to explain the result, so the number is calculated rather than guessed.

Under both providers' API terms, inputs and outputs sent through their APIs are not used to train their models. We are on their standard commercial terms and have not negotiated a zero-retention agreement with either, so we describe it that way rather than claiming more.

If your policy is that nothing may reach an external model, the natural-language layer can be switched off for your organisation and everything else keeps working.

Each of these is implemented, not planned. A reviewer can check most of them against the product itself.

• Your rows never leave our servers

  Uploaded files are read on our backend. Forecasting, clustering, anomaly detection, correlation, data cleaning, chart rendering and pipeline generation all run in our own process, with no external call at any point.

• The AI model sees a statistical description, not your data

  For the natural-language features we send column names, types, row and null counts, numeric ranges and averages. We do not send rows, files or samples of your records.

• You decide what the model may see

  Columns that look like identifiers are withheld automatically. You can mark any other column sensitive, and your organisation can switch off category values entirely.

• Customer content is encrypted with a key our hosting providers do not hold

  Questions, answers, chart data, dataset profiles, business context and stored credentials are encrypted with AES-256-GCM at the application layer, on top of the disk encryption our database and object storage already provide.

• Two-step verification, and sessions you can end

  TOTP with single-use recovery codes. Signing out ends the session on our side immediately, you can see every device you are signed in on, and an owner can require two-step verification of the whole organisation.

• Every access is logged, and the log is tamper-evident

  Who did what, to which dataset, from where. Each entry is hashed over its own contents and chained to the entry before it, so an edited or removed record is detectable. Owners and admins can run that check themselves from the product.

• Roles govern what you can do, sharing governs what you can read

  An administrator has every capability and still cannot open a colleague’s dataset unless it was shared with them. They can see that it exists, because governance needs an inventory, and that is not the same as reading it.

• Retention, export and deletion are yours to run

  Choose a retention window and data older than it is purged automatically. Export everything we hold as JSON, or delete your account and receive a receipt of exactly what went.

• Card details never touch our systems

  Payment is handled by Stripe Checkout, which is hosted by Stripe. We store an identifier, never a card number.

• No trackers, no analytics, no third-party scripts in the product

  There is no tag manager, no session recorder and no advertising pixel anywhere in the signed-in application, and its security policy blocks script from any host we do not control. The only outbound services are the ones listed below. Our public website is the one exception, and only if you accept it: see Cookies.

These are every third party that can process customer data on our behalf. We will update this page before adding another.

Our public pages (the home, features, pricing and this page) can use Apollo.io to tell us which companies visit the site. It loads only after you press Accept on the cookie banner. It then stores an anonymous ID in your browser and sends Apollo the pages you view, the site that referred you and any campaign tags in the link. Apollo uses your IP address to work out which organisation is visiting.

It never loads inside the product. Every page that can show your data runs under a security policy that blocks Apollo, and signing in reloads the page so nothing loaded on the public site carries over. Apollo is therefore not a sub-processor: it never receives customer data. We also block the add-on Apollo’s tracker uses to match visitors to email addresses.

The only other things we keep in your browser are essential: your sign-in session, your theme choice and your cookie answer.

Cookie settings to change your answer at any time.

• Access log. See every action taken on your account, from inside the product.
• Retention. Choose 30, 60, 90, 180, 365 or 730 days, after which uploaded data is deleted automatically. The default is to keep your data until you delete it, because silently removing your work would be worse.
• Export. Download everything we hold about your account as JSON, including the access log.
• Deletion. Delete your account yourself and get a receipt listing what was removed. Any live subscription is cancelled first, so a deleted account is never still billed.

The access log itself is retained with your account identifier removed. Erasing the record that an action happened would defeat the purpose of keeping one, and every privacy regime we operate under permits retaining it for exactly that reason.

We will tell you. Our commitment is to notify affected customers within 72 hours of confirming a breach that affects their data, with what we know, what we do not yet know, and what we are doing about it. That is the GDPR standard and we apply it to every customer regardless of where they are.

Security researchers: please report findings to security@opticsbi.com. We acknowledge within two business days. Full policy at /.well-known/security.txt.

The list below is here because a security team will find it anyway, and finding it unlisted is what turns a manageable gap into a lost deal.

SOC 2

Not certified, and we do not claim to be. The controls an audit examines are implemented; the audit itself is a five-figure annual commitment we will make when our revenue justifies it.

ISO 27001

Not certified. Same reasoning as SOC 2.

HIPAA

We are not a business associate and hold no BAAs. Do not upload protected health information.

Third-party penetration test

Not yet commissioned. We will publish the summary when it is.

Data residency outside the United States

Not available. All processing and storage is in the United States today.

Customer-managed encryption keys, single-tenant deployment, SSO and SCIM

Not built. Talk to us if one of these is a requirement rather than a preference.

We also grandfathered email verification for accounts created before 29 August 2026. Those addresses were never confirmed by a link. Every account created since must confirm before it can invite anyone.

Available on request, usually the same day:

• Data Processing Agreement, ready to sign
• Security overview and control descriptions
• CAIQ (Cloud Security Alliance) responses
• AI-specific questionnaire responses, covering model use and data flows
• Incident response plan
• Sub-processor list with change notification

Email security@opticsbi.com and tell us which questionnaire you use. If it is one we have not seen, send it over and we will complete it.