# Glossy Data security overview

Supplier: Glossy Data. Contact us at www.glossydata.com/contact.

Last reviewed: 2026-10-18. Live version: https://www.glossydata.com/trust

This pack says what we do today, what's coming and what we don't offer. If something you need isn't here, we probably don't have it yet; the status table says what's coming. Security questions and vulnerability reports: security@glossydata.com (written replies).

## 1. At a glance

| Area | Status | Detail |
|---|---|---|
| Hosting | Yes | Runs entirely on Cloudflare (Workers, D1, Durable Objects) on Cloudflare's global network. We run no servers of our own. |
| Encryption | Yes | TLS in transit. Encrypted at rest. |
| Customer data separation | Yes | Each customer's data is kept separate, and access is checked on every request. |
| IP addresses | Not stored | We don't store IP addresses. Abuse checks use a salted one-way hash, deleted within 48 hours. |
| Sign-in | Yes | Email verification code, magic link or Google when configured. A password can only be added through a verified email link. |
| Roles | Yes | Owner, admin, member and client viewer. |
| SSO (SAML / OIDC) | Live · SAML beta | Set up yourself in Settings on plans that include it: OIDC, SAML (beta) and domain verification. |
| Audit log | Yes | Workspace audit log with CSV export on plans that include it. |
| API keys | Yes | Scoped keys, stored hashed, with rotation. |
| SCIM provisioning | Coming soon | Coming soon. Not available today. |
| Two-factor authentication | Not offered | Not offered beyond what your Google account or email inbox provides. |
| SOC 2 | Not certified | SOC 2 certification is not currently held. Review the security pack for our current controls and certification status. |
| ISO 27001 | Not certified | Not held. |
| Penetration test | Not yet | No independent penetration test report yet. |
| UK GDPR | Yes | We're a UK company. The ICO is our regulator. |
| Data processing agreement | Yes | Part of our terms. It applies automatically. |
| Sub-processors | Published | Listed below, with at least 30 days' notice of a new one by email. |
| Data residency choice | Not offered | Not offered. Data is processed on Cloudflare's global network. |
| Uptime SLA | Coming soon | Coming soon. No uptime SLA today. |

## 2. Infrastructure

Glossy Data's application, database and background jobs run on Cloudflare. We don't run servers of our own.

- Application: Cloudflare Workers. Database: Cloudflare D1. Scheduling and coordination: Durable Objects.
- Bot protection (Cloudflare Turnstile) and rate limiting on every public form, including the free check.
- AI answers are collected through the providers listed under sub-processors. We don't log in to AI engines as anyone.

## 3. Application security

- A strict content security policy on every page, with per-request nonces or hashes, so injected scripts don't run.
- Websites you give us are checked before we fetch them: no IP addresses, private networks or internal hosts.
- Secrets and API keys are kept out of code.
- Pages that set a cookie are never cached by a shared cache.
- Each customer's data is kept separate, with access checked on every request.

## 4. Access

- Verify your email with a code for a free report. Magic-link and Google sign-in are also available when configured.
- Four roles: owner, admin, member and client viewer. Agency clients only see their own workspace, and never billing.
- Only the owner can refund or close an organization.
- Staff access is limited to what's needed to run the service.
- SSO you set up yourself with your identity provider (OIDC, and SAML in beta), with domain verification, on plans that include it.

## 5. Privacy and data handling

- What we hold: your account details, the websites, questions and competitors you track, and the AI answers we collect for them.
- What AI providers receive: the questions we track and the locations they're asked from, never your account details. ChatGPT, Gemini and Google AI answers are collected through DataForSEO. Perplexity, Anthropic (Claude) and, when configured, xAI (Grok) and DeepSeek receive the questions directly; Anthropic also receives answer text for analysis. Every provider is listed under sub-processors.
- IP addresses: not stored.
- Deletion: close your account and erase your data yourself. We delete personal data within 30 days of closure; backups are overwritten in the normal cycle.
- Transfers outside the UK: the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK IDTA / UK Addendum to the EU SCCs.
- We don't need health, financial or other sensitive personal data, and you shouldn't put any into Glossy Data.

## 6. Incidents and disclosure

- If a personal data breach affects your data, we'll tell you without undue delay and give you what you need to notify regulators.
- Found a vulnerability? Email security@glossydata.com with the details. We reply in writing. Please don't test against other customers' data.

## 7. What we won't do

- Show certification badges we haven't earned.
- Log in to AI engines as anyone, or get around their security checks.
- Sell your data, or use people's private AI chats.

## 8. Sub-processors

| Provider | What they do for us | What they receive | Where | When we use them |
|---|---|---|---|---|
| Cloudflare | Hosting, database, background jobs, bot protection (Turnstile), text analysis (Workers AI), routing of AI API calls (AI Gateway) and email sending | All service data, as our host | Global network; US company | Always |
| Stripe | Payments, invoices and subscriptions | Name, email, billing address, payment details. We never see your full card number | UK, EU and US | When you buy a plan |
| DataForSEO | Collects answers from ChatGPT, Gemini, Google AI Overviews and Google AI Mode, as the public sees them | The questions we track and the locations they're asked from. Not your personal data | Location: see DataForSEO's privacy policy (https://dataforseo.com/privacy-policy) | Always (every plan and the free check) |
| Anthropic | Claude API: Claude answers (with web search), and quality checks on a small sample of answer analysis | The questions we track, the location they're asked from and the text of AI answers | US | Always on paid plans |
| Perplexity | Sonar API: Perplexity answers (with web search) | The questions we track and the location they're asked from | US | Always |
| xAI | Grok API (with web search): Grok answers | The questions we track and the location they're asked from. Not your personal data | US | When Grok is configured on our service. It is not opt-in per organization: while configured, it receives the questions of every project that tracks Grok |
| DeepSeek | DeepSeek API: DeepSeek answers from model knowledge (no web search) | The questions we track and the country they're asked from. Not your personal data | People's Republic of China | When DeepSeek is configured on our service. It is not opt-in per organization: while configured, it receives the questions of every project that tracks DeepSeek |
| OpenAI | Optional ChatGPT developer-API lane, for comparison with consumer ChatGPT answers | The questions we track and the location they're asked from | US | Not in use: no OpenAI connection is switched on today. Consumer ChatGPT answers come through DataForSEO |
| Google | Google sign-in, and the Search Console and Analytics APIs when you connect them | For sign-in, your Google account name and email. For connected properties, access tokens and the search and analytics data you choose to connect | US company; global infrastructure | Only when you sign in with Google or connect a Google property |
| Resend | Transactional email, only as a backup to Cloudflare email sending | Your email address and the email content | US | Off today. Switched on only if Cloudflare email sending fails |

We give at least 30 days' notice of a new sub-processor by email. You can object on reasonable data protection grounds.

Integrations you connect yourself (such as your identity provider for SSO) receive data on your instructions; they are your providers, not our sub-processors.

## 9. Retention

| Data | How long |
|---|---|
| Account data | For the life of your account, plus 30 days |
| Billing records | 6 years, as HMRC requires |
| Free check results and leads | 12 months |
| Raw AI answers | 13 months, for trend history. After that we keep only aggregated figures |
| Server and security logs | 30 days |
| Workspace audit log (sign-ins, settings, API keys, SSO, billing changes) | 365 days on Enterprise plans, 90 days on other plans |
| Marketing consent records | As long as you're subscribed, plus 2 years as proof of consent |

Abuse-check hashes of IP addresses: 48 hours.

## 10. Documents

- Data processing agreement: https://www.glossydata.com/legal/dpa
- Privacy notice: https://www.glossydata.com/legal/privacy
- Terms of service: https://www.glossydata.com/legal/terms
- Methodology: https://www.glossydata.com/methodology