# Glossy Data security questionnaire (pre-filled)

Last reviewed: 2026-10-18. Live version: https://www.glossydata.com/trust

A self-assessment in the style of SIG Lite / CSA CAIQ, grouped by CAIQ-style domains with our own question ids. It is not an official CAIQ or SIG submission. Every answer comes from our trust page; "Not yet" means it isn't in place today.

## Governance and compliance

| ID | Question | Answer | Detail |
|---|---|---|---|
| GRC-01 | Do you hold a current SOC 2 Type I or Type II report? | Not yet | SOC 2 certification is not currently held. Review the security pack for our current controls and certification status. |
| GRC-02 | Are you certified to ISO/IEC 27001? | No | Not held. |
| GRC-03 | Has an independent penetration test been performed in the last 12 months? | Not yet | No independent penetration test report yet. |
| GRC-04 | Which data protection law applies, and who is your regulator? | Yes | We're a UK company. The ICO is our regulator. |
| GRC-05 | What is your registered legal entity? | Not yet | Glossy Data. Contact us at www.glossydata.com/contact. |

## Infrastructure

| ID | Question | Answer | Detail |
|---|---|---|---|
| IVS-01 | Where is the service hosted? | Yes | Runs entirely on Cloudflare (Workers, D1, Durable Objects) on Cloudflare's global network. We run no servers of our own. |
| IVS-02 | Do you offer a choice of data residency region? | No | Not offered. Data is processed on Cloudflare's global network. |
| IVS-03 | Do you offer a contractual uptime SLA? | Not yet | Coming soon. No uptime SLA today. |

## Encryption

| ID | Question | Answer | Detail |
|---|---|---|---|
| CEK-01 | Is customer data encrypted in transit and at rest? | Yes | TLS in transit. Encrypted at rest. |

## Data security and privacy

| ID | Question | Answer | Detail |
|---|---|---|---|
| DSP-01 | Is each customer's data logically separated from other customers'? | Yes | Each customer's data is kept separate, and access is checked on every request. |
| DSP-02 | Do you store end-user IP addresses? | No | We don't store IP addresses. Abuse checks use a salted one-way hash, deleted within 48 hours. |
| DSP-03 | Do you offer a data processing agreement (UK GDPR Article 28)? | Yes | Part of our terms. It applies automatically. |
| DSP-04 | What do AI providers receive? | Yes | What AI providers receive: the questions we track and the locations they're asked from, never your account details. ChatGPT, Gemini and Google AI answers are collected through DataForSEO. Perplexity, Anthropic (Claude) and, when configured, xAI (Grok) and DeepSeek receive the questions directly; Anthropic also receives answer text for analysis. Every provider is listed under sub-processors. |
| DSP-05 | Do you transfer personal data outside the UK, and under which safeguards? | Yes | Transfers outside the UK: the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK IDTA / UK Addendum to the EU SCCs. |
| DSP-06 | Do you publish a retention schedule? | Partial | Account data: For the life of your account, plus 30 days; Billing records: 6 years, as HMRC requires; Free check results and leads: 12 months; Raw AI answers: 13 months, for trend history. After that we keep only aggregated figures; Server and security logs: 30 days; Workspace audit log (sign-ins, settings, API keys, SSO, billing changes): 365 days on Enterprise plans, 90 days on other plans; Marketing consent records: As long as you're subscribed, plus 2 years as proof of consent; abuse-check hashes of IP addresses: 48 hours. The privacy notice still marks these periods as a draft. |
| DSP-07 | Can customers delete their data, and how quickly is it deleted? | Yes | Deletion: close your account and erase your data yourself. We delete personal data within 30 days of closure; backups are overwritten in the normal cycle. |

## Supply chain (sub-processors)

| ID | Question | Answer | Detail |
|---|---|---|---|
| STA-01 | Do you publish your sub-processors, with notice of changes? | Yes | 10 listed: Cloudflare, Stripe, DataForSEO, Anthropic, Perplexity, xAI, DeepSeek, OpenAI, Google, Resend. We give at least 30 days' notice of a new sub-processor by email. You can object on reasonable data protection grounds. |
| STA-02 | Cloudflare: what does it do, what does it receive, where, and when is it used? | Yes | Hosting, database, background jobs, bot protection (Turnstile), text analysis (Workers AI), routing of AI API calls (AI Gateway) and email sending. Receives: All service data, as our host. Where: Global network; US company. When: Always. |
| STA-03 | Stripe: what does it do, what does it receive, where, and when is it used? | Yes | Payments, invoices and subscriptions. Receives: Name, email, billing address, payment details. We never see your full card number. Where: UK, EU and US. When: When you buy a plan. |
| STA-04 | DataForSEO: what does it do, what does it receive, where, and when is it used? | Yes | Collects answers from ChatGPT, Gemini, Google AI Overviews and Google AI Mode, as the public sees them. Receives: The questions we track and the locations they're asked from. Not your personal data. Where: Location: see DataForSEO's privacy policy (https://dataforseo.com/privacy-policy). When: Always (every plan and the free check). |
| STA-05 | Anthropic: what does it do, what does it receive, where, and when is it used? | Yes | Claude API: Claude answers (with web search), and quality checks on a small sample of answer analysis. Receives: The questions we track, the location they're asked from and the text of AI answers. Where: US. When: Always on paid plans. |
| STA-06 | Perplexity: what does it do, what does it receive, where, and when is it used? | Yes | Sonar API: Perplexity answers (with web search). Receives: The questions we track and the location they're asked from. Where: US. When: Always. |
| STA-07 | xAI: what does it do, what does it receive, where, and when is it used? | Yes | Grok API (with web search): Grok answers. Receives: The questions we track and the location they're asked from. Not your personal data. Where: US. When: When Grok is configured on our service. It is not opt-in per organization: while configured, it receives the questions of every project that tracks Grok. |
| STA-08 | DeepSeek: what does it do, what does it receive, where, and when is it used? | Yes | DeepSeek API: DeepSeek answers from model knowledge (no web search). Receives: The questions we track and the country they're asked from. Not your personal data. Where: People's Republic of China. When: When DeepSeek is configured on our service. It is not opt-in per organization: while configured, it receives the questions of every project that tracks DeepSeek. |
| STA-09 | OpenAI: what does it do, what does it receive, where, and when is it used? | Yes | Optional ChatGPT developer-API lane, for comparison with consumer ChatGPT answers. Receives: The questions we track and the location they're asked from. Where: US. When: Not in use: no OpenAI connection is switched on today. Consumer ChatGPT answers come through DataForSEO. |
| STA-10 | Google: what does it do, what does it receive, where, and when is it used? | Yes | Google sign-in, and the Search Console and Analytics APIs when you connect them. Receives: For sign-in, your Google account name and email. For connected properties, access tokens and the search and analytics data you choose to connect. Where: US company; global infrastructure. When: Only when you sign in with Google or connect a Google property. |
| STA-11 | Resend: what does it do, what does it receive, where, and when is it used? | Yes | Transactional email, only as a backup to Cloudflare email sending. Receives: Your email address and the email content. Where: US. When: Off today. Switched on only if Cloudflare email sending fails. |

## Identity and access

| ID | Question | Answer | Detail |
|---|---|---|---|
| IAM-01 | How do users sign in? | Yes | Email verification code, magic link or Google when configured. A password can only be added through a verified email link. |
| IAM-02 | Do you support SSO (SAML / OIDC)? | Partial | Set up yourself in Settings on plans that include it: OIDC, SAML (beta) and domain verification. |
| IAM-03 | Do you support SCIM user provisioning? | Not yet | Coming soon. Not available today. |
| IAM-04 | Do you offer two-factor authentication? | No | Not offered beyond what your Google account or email inbox provides. |
| IAM-05 | Do you support role-based access control? | Yes | Owner, admin, member and client viewer. |
| IAM-06 | Are API keys scoped and stored hashed? | Yes | Scoped keys, stored hashed, with rotation. |

## Logging and monitoring

| ID | Question | Answer | Detail |
|---|---|---|---|
| LOG-01 | Do customers get an audit log of security-relevant events? | Yes | Workspace audit log with CSV export on plans that include it. |

## Application security

| ID | Question | Answer | Detail |
|---|---|---|---|
| AIS-01 | Do you apply a content security policy and validate untrusted input? | Yes | A strict content security policy on every page, with per-request nonces or hashes, so injected scripts don't run. Websites you give us are checked before we fetch them: no IP addresses, private networks or internal hosts. |
| AIS-02 | Are public forms protected against bots and abuse? | Yes | Bot protection (Cloudflare Turnstile) and rate limiting on every public form, including the free check. |
| AIS-03 | Are secrets kept out of source code? | Yes | Secrets and API keys are kept out of code. |

## Incident response

| ID | Question | Answer | Detail |
|---|---|---|---|
| SEF-01 | Will you notify us of a personal data breach? | Yes | If a personal data breach affects your data, we'll tell you without undue delay and give you what you need to notify regulators. |
| SEF-02 | Do you have a vulnerability disclosure channel? | Yes | Found a vulnerability? Email security@glossydata.com with the details. We reply in writing. Please don't test against other customers' data. |