Security

01

We only read

BayesBrain reads from the tools you connect and never creates, changes or deletes anything in them: the code makes no calls that write to a connected tool. Stripe, Google Analytics, Google Search Console, PostHog and Cloudflare connect with read-only permissions. A few tools have no read-only option, or connect with an API key you create; from those, too, we only read.

02

Encryption

Every connection to the app, the API and the database uses HTTPS (TLS). The database is encrypted at rest with AES-256 by our database provider, Supabase. Access tokens, refresh tokens and API keys for your connected tools are also encrypted by our own API before they are stored, with authenticated encryption (libsodium, XSalsa20-Poly1305) and a key we hold outside the database.

03

Separation between companies

Every request is tied to one company the signed-in user or API key has access to, and every query is filtered to that company. Row-level security is enabled on every table in the database as a second safeguard. BayesBrain staff may view an account read-only to provide support.

04

AI and your data

Anthropic’s Claude writes your briefs and analysis, through Anthropic’s commercial API, whose terms do not allow Anthropic to train models on customer content. Voyage AI turns the company description you enter for the funding match into an embedding; we have opted out of Voyage AI using our data for training, and under its terms content sent after the opt-out is deleted once it has been processed.

05

Connector usage

When you use BayesBrain through Claude or another assistant connected to it (MCP), we record each tool the assistant calls: which tool, the parameters it was called with (such as a metric name, a time window or a limit), when, how long it took, whether it worked, how many rows it returned, which app made the call and whose connection it used. We never record the questions you ask the assistant or the data BayesBrain returns. We use this to see which parts of BayesBrain are used and to set the connector's price. Each record is kept for 24 months and then reduced to monthly counts per company, tool and metric. When a user or company is deleted, the records keep no link to them.

06

Disconnecting and deletion

Disconnect any tool from the Integrations page at any time. Its stored access is deleted at once, syncing stops, and the data synced from it is deleted within 30 days. Some tools keep BayesBrain listed as connected on their side until you remove it there as well. To delete your whole account, write to us: deletion is done on request today. See Delete your data.

07

Where your data is

Your company’s data is stored in our Supabase database in Frankfurt, Germany. The API and background jobs run in the Netherlands (Railway), and the web app’s server functions in Stockholm, Sweden (Vercel). Our AI providers and website reader may process what we send them outside the EU; the list below says where.

08

Subprocessors

09

Contact

Security questions, or something to report: hello@bayesbrain.ai