This page describes how Productised protects the data our customers and their audiences trust us with. It is a plain-language version of the technical and organisational measures in Annex 2 of our Data Processing Agreement. Everything here is in place today, and we say plainly what is not.
Access control
- Every request for a customer's data is checked on our servers against membership of the account that owns it.
- A failed check returns "not found", so nobody can discover which records exist.
- Team members have roles. Billing, API keys and data retention settings are limited to account owners and admins.
- Sign-in sessions use secure, HTTP-only cookies.
Separation between customers
- Every database query is scoped to one account and one workspace. An agency's clients are kept apart from each other, as well as from other customers.
- The Claude connector authenticates with a separate token for each user and works in one workspace at a time.
Encryption
- All traffic is encrypted with HTTPS, including on customers' own custom domains, which get certificates automatically.
- The database and its backups are encrypted at rest.
- Customers' own AI provider keys are encrypted again before we store them, and are never shown in full after they are saved.
Data minimisation and AI
- We do not keep a log of visitors' IP addresses.
- Page analytics on public product pages is cookieless and collects no personal data.
- Our AI providers process data under API terms that do not allow them to train their models on it.
- Every public product page tells visitors that their answers are processed by AI.
Deletion and retention
- Customers can delete individual leads in the app and through the Claude connector.
- Deleting a product, workspace or account deletes everything inside it.
- Each workspace can set an automatic retention period, after which leads are deleted.
- When an account closes, the customer can export their data, and we delete it within 30 days.
Reliability and monitoring
- At least two application servers run at all times. Updates roll out gradually and roll back automatically if they fail.
- Database backups are managed by our database provider.
- Error rates on the Claude connector are monitored automatically, with email alerts.
- Passwords, keys and other secrets are never written to logs.
How we build
- Changes that touch sign-in, credentials, user input or customer data go through a security design review and a security code review before release.
What we are still putting in place
We would rather tell you than have you find out:
- A written, rehearsed incident response plan. We commit to telling affected customers about a personal data breach within 48 hours of becoming aware of it.
- Regular, documented tests of restoring from backup.
- Formal security training. Productised is a team of three, with no separate security team.
- An independent certification such as SOC 2 or ISO 27001. We have not been audited yet.
Reporting a security issue
If you think you have found a security problem, email privacy@productised.ai. Please give us a chance to fix it before telling anyone else.
