Security and data handling.
What the system does today, and what this page does not yet cover.
What the system does
Personal information stays out of the logs.
Our application logging records identifiers rather than attribute values, and does not write request bodies, response bodies, headers or query strings. That is why an erasure request is a database operation rather than a hunt through log archives.
A redaction pass as a safety net.
A final formatting pass masks phone numbers, email addresses, tax identifiers, and secrets anywhere they might have leaked into a log line or an error trace. This is explicitly a backstop; the primary control is not logging values at all.
Submitted credentials are not echoed back.
A value submitted to the system is not returned to the caller in an error message.
Extraction cannot write to your systems.
The extraction path to an external system has no write capability — structurally incapable of modifying a source system, not merely configured not to.
Least privilege on analytics.
The reporting layer connects through a read-only role scoped to a single schema. It cannot modify data and cannot reach unprocessed source records.
Dry run is the default.
Every enrichment operation reads, computes the exact before-and-after, and writes a report. Persisting anything requires an explicit instruction.
Provenance on everything derived.
Every enriched or model-generated value carries its source, its confidence, and when it was produced. Model output never overwrites a system-of-record value.
An append-only audit trail.
Every state change records what changed, when, who or what triggered it, and why. Audit records are never rewritten.
Secrets are held as configuration.
Never stored in the database or in documentation.
Where your data goes
Enrichment uses third-party models, and running it transmits some personal information — party names and email addresses — to the configured model provider. That happens on a dry run too: a dry run withholds the write to our database, not the call to the provider.
What this page doesn't cover yet
Encryption, hosting region, retention periods, backups and access control aren't described here yet. We'd rather leave them out than describe them loosely. If you're doing diligence and need them, ask and we'll answer specifically.