Security and trust
Security and trust, without the fine print
What we do to protect your data today, what we are working on, and what we don't offer yet. If a badge isn't on this page, we don't have it.
Markdown · 9.1 KB · last reviewed · no sign-up, no form
At a glance
Every status, in one place.
Live means it works today. Coming soon means it isn't available yet. Not offered means we don't have it.
- HostingLiveRuns entirely on Cloudflare (Workers, D1, Durable Objects) on Cloudflare's global network. We run no servers of our own.
- EncryptionLiveTLS in transit. Encrypted at rest.
- Customer data separationLiveEach customer's data is kept separate, and access is checked on every request.
- IP addressesNot storedWe don't store IP addresses. Abuse checks use a salted one-way hash, deleted within 48 hours.
- Sign-inLiveEmail verification code, magic link or Google when configured. A password can only be added through a verified email link.
- RolesLiveOwner, admin, member and client viewer.
- SSO (SAML / OIDC)Live · SAML betaSet up yourself in Settings on plans that include it: OIDC, SAML (beta) and domain verification.
- Audit logLiveWorkspace audit log with CSV export on plans that include it.
- API keysLiveScoped keys, stored hashed, with rotation.
- SCIM provisioningComing soonComing soon. Not available today.
- Two-factor authenticationNot offeredNot offered beyond what your Google account or email inbox provides.
- SOC 2Not certifiedSOC 2 certification is not currently held. Review the security pack for our current controls and certification status.
- ISO 27001Not certifiedNot held.
- Penetration testNot yetNo independent penetration test report yet.
- UK GDPRLiveWe're a UK company. The ICO is our regulator.
- Data processing agreementLivePart of our terms. It applies automatically.
- Sub-processorsPublishedListed below, with at least 30 days' notice of a new one by email.
- Data residency choiceNot offeredNot offered. Data is processed on Cloudflare's global network.
- Uptime SLAComing soonComing soon. No uptime SLA today.
How data flows
What goes where.
From the moment you add a website to the answers we store.
- 1Your browserYou add websites, questions and competitors. Bot protection on public forms
- 2Our appCloudflare Workers. Access checked on every request; no IP addresses stored
- 3AI providersThe questions we track and where they're asked from. Not your personal data
- 4ExtractionWho's named and which sources are cited, on Cloudflare (plus a checked sample)
- 5StorageCloudflare D1. Raw answers kept for trend history, then aggregated
| Data | How long |
|---|---|
| Account data | For the life of your account, plus 30 days |
| Billing records | 6 years, as HMRC requires |
| Free check results and leads | 12 months |
| Raw AI answers | 13 months, for trend history. After that we keep only aggregated figures |
| Server and security logs | 30 days |
| Workspace audit log (sign-ins, settings, API keys, SSO, billing changes) | 365 days on Enterprise plans, 90 days on other plans |
| Marketing consent records | As long as you're subscribed, plus 2 years as proof of consent |
| Abuse-check hashes of IP addresses | 48 hours |
Our privacy notice still marks these retention periods as a draft, pending confirmation before launch.
Infrastructure
Everything runs on Cloudflare.
Glossy Data's application, database and background jobs run on Cloudflare. We don't run servers of our own.
- Application: Cloudflare Workers. Database: Cloudflare D1. Scheduling and coordination: Durable Objects.
- Bot protection (Cloudflare Turnstile) and rate limiting on every public form, including the free check.
- AI answers are collected through the providers listed under sub-processors. We don't log in to AI engines as anyone.
Application security
How we protect access to your data.
- A strict content security policy on every page, with per-request nonces or hashes, so injected scripts don't run.
- Websites you give us are checked before we fetch them: no IP addresses, private networks or internal hosts.
- Secrets and API keys are kept out of code.
- Pages that set a cookie are never cached by a shared cache.
- Each customer's data is kept separate, with access checked on every request.
Access
Who can see what.
- Verify your email with a code for a free report. Magic-link and Google sign-in are also available when configured.
- Four roles: owner, admin, member and client viewer. Agency clients only see their own workspace, and never billing.
- Only the owner can refund or close an organization.
- Staff access is limited to what's needed to run the service.
- SSO you set up yourself with your identity provider (OIDC, and SAML in beta), with domain verification, on plans that include it.
Privacy and data handling
What we hold, and for how long.
- What we hold: your account details, the websites, questions and competitors you track, and the AI answers we collect for them.
- What AI providers receive: the questions we track and the locations they're asked from, never your account details. ChatGPT, Gemini and Google AI answers are collected through DataForSEO. Perplexity, Anthropic (Claude) and, when configured, xAI (Grok) and DeepSeek receive the questions directly; Anthropic also receives answer text for analysis. Every provider is listed under sub-processors.
- IP addresses: not stored.
- Deletion: close your account and erase your data yourself. We delete personal data within 30 days of closure; backups are overwritten in the normal cycle.
- Transfers outside the UK: the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK IDTA / UK Addendum to the EU SCCs.
- We don't need health, financial or other sensitive personal data, and you shouldn't put any into Glossy Data.
Sub-processors
Who processes data for us.
We give at least 30 days' notice of a new sub-processor by email. You can object on reasonable data protection grounds.
| Provider | What they do for us | What they receive | Where | When we use them |
|---|---|---|---|---|
| Cloudflare | Hosting, database, background jobs, bot protection (Turnstile), text analysis (Workers AI), routing of AI API calls (AI Gateway) and email sending | All service data, as our host | Global network; US company | Always |
| Stripe | Payments, invoices and subscriptions | Name, email, billing address, payment details. We never see your full card number | UK, EU and US | When you buy a plan |
| DataForSEO | Collects answers from ChatGPT, Gemini, Google AI Overviews and Google AI Mode, as the public sees them | The questions we track and the locations they're asked from. Not your personal data | Location: see DataForSEO's privacy policy | Always (every plan and the free check) |
| Anthropic | Claude API: Claude answers (with web search), and quality checks on a small sample of answer analysis | The questions we track, the location they're asked from and the text of AI answers | US | Always on paid plans |
| Perplexity | Sonar API: Perplexity answers (with web search) | The questions we track and the location they're asked from | US | Always |
| xAI | Grok API (with web search): Grok answers | The questions we track and the location they're asked from. Not your personal data | US | When Grok is configured on our service. It is not opt-in per organization: while configured, it receives the questions of every project that tracks Grok |
| DeepSeek | DeepSeek API: DeepSeek answers from model knowledge (no web search) | The questions we track and the country they're asked from. Not your personal data | People's Republic of China | When DeepSeek is configured on our service. It is not opt-in per organization: while configured, it receives the questions of every project that tracks DeepSeek |
| OpenAI | Optional ChatGPT developer-API lane, for comparison with consumer ChatGPT answers | The questions we track and the location they're asked from | US | Not in use: no OpenAI connection is switched on today. Consumer ChatGPT answers come through DataForSEO |
| Google sign-in, and the Search Console and Analytics APIs when you connect them | For sign-in, your Google account name and email. For connected properties, access tokens and the search and analytics data you choose to connect | US company; global infrastructure | Only when you sign in with Google or connect a Google property | |
| Resend | Transactional email, only as a backup to Cloudflare email sending | Your email address and the email content | US | Off today. Switched on only if Cloudflare email sending fails |
Integrations you connect yourself (such as your identity provider for SSO) receive data on your instructions; they are your providers, not our sub-processors.
The same list is in our DPA and privacy notice, and in the CSV download.
Incidents and disclosure
If something goes wrong.
- If a personal data breach affects your data, we'll tell you without undue delay and give you what you need to notify regulators.
- Found a vulnerability? Email security@glossydata.com with the details. We reply in writing. Please don't test against other customers' data.
What we won't do
Lines we don't cross.
- Show certification badges we haven't earned.
- Log in to AI engines as anyone, or get around their security checks.
- Sell your data, or use people's private AI chats.
Security pack
Everything procurement needs, in one download.
No call, no form, no NDA to request it. Generated from this page, so the two always match.
Draft: our registered company details are not published yet, and these documents are pending solicitor review. Don't rely on them as final.
- Download
Security overview
Everything on this page: statuses, infrastructure, access, privacy, sub-processors and retention.
Markdown · 9.1 KB · updated
- Download
Sub-processor list
Provider, what they do for us, what they receive, where and when we use them.
CSV · 2.6 KB · updated
- Download
Security questionnaire (pre-filled)
SIG Lite / CAIQ-style answers from this page, with "Not yet" where something isn't in place. Also as Markdown.
CSV · 9.8 KB · updated
Markdown version (10.0 KB)
If your review needs something that isn't here, it's probably something we don't have yet. The status list above says what's coming.
See what AI says about you, free.
Start with a limited report after email verification, or explore the interactive demo.
- Free
- Verify your email
- No call