Your data stays yours, protected at every layer

Each company’s AI register is its own. See where it runs, who can reach it and how it is protected, with the documents your procurement team asks for.

Download the agreementDownload the questionnaire
Encrypted in transit and at restNever used to train AIDeleted within three days of closure

Powered by tools audited to SOC 2 and certified to ISO 27001 and ISO 42001.

AICPA SOC 2ISO 27001 certified by SchellmanISO 42001 certified by Schellman

Certifications held by the providers we run on. See the providers

For your procurement team

Data processing agreementPDF · Version 1.0 · November 2026Security questionnaire, answeredPDF · Version 1.1 · November 2026Privacy policyVersion 3.5TermsVersion 2.0Country complianceVersion 3.0, with every provider we use

Questions on security or privacy: privacy@pspsignaldesk.com

Your company’s data stays your company’s

Your register opens only through your own signed-in account, so one company never sees another’s.

Whose data it is

Your register, its findings and its reports belong to your company. Our team sees your sign-up and billing details, and nothing of your AI tools, answers or results.

Who sees what

Your account owner sees the findings. Staff declare their own AI tools through a private link, and see the register only when the owner shares it.

Where it runs

The platform runs on Cloudflare’s network, with its processing placed in Jakarta. AI analysis, email and card payments are handled by providers in the United States.

How access is controlled

Sign in with a one-time code sent to your work email, or with Google. Sessions are signed and short, and every connection to Microsoft 365, Google Workspace, Okta or Slack only reads.

How it is protected

Encryption in transit and at rest, connection credentials encrypted under a separate key, and a nightly copy of every record kept for 30 days.

Your rights, and closing your account

Ask for a copy, a correction or deletion at any time, answered within three days. When you close your account, your register and everything it found are deleted within three days.

AI that works for you, and never trains on your data

AI analysis runs under Anthropic’s commercial terms, through a relay placed in Singapore.

Never used for training.

Under Anthropic’s commercial terms, nothing you send is used to train AI models.

Deleted within 30 days.

Anthropic deletes what it receives and returns within 30 days.

Only what each check needs.

To check a connected app, only the app’s name is sent; your staff details stay in your account. A document you upload is read for your session and never stored.

A person makes the decisions.

The platform explains and prioritises. It makes no decision about any individual, and anyone can ask for a human review.

Protected at every layer, from sign-in to storage

Keys and secrets live only in the platform’s runtime settings, never in code, and every change is reviewed before it is released.

In transit

TLS on every address, with HSTS for a year including subdomains, a content security policy and frame protection on every page.

At rest

Every record and file encrypted with AES-256-GCM on Cloudflare. Passwords are salted hashes, and connection credentials are encrypted under a key kept apart from the data.

Sign-in

One-time codes and Google sign-in, signed 30-minute sessions renewed from a secure cookie, and limits on repeated attempts.

Connections

Microsoft 365, Google Workspace, Okta and Slack connect read-only. Disconnecting revokes access at the provider and deletes the stored credential.

Backups

Every record copied each night to a private store in Cloudflare’s Asia-Pacific region and kept for 30 days.

Breach notice

You are told within three days of a breach of personal data being confirmed, and within 72 hours where the law requires.

The providers we run on

Each provider works under written terms that protect your data. We give 30 days’ notice before a new provider handles your data, and you may object.

ProviderRoleWhereAttestations or terms, as each provider publishes them
Cloudflare, Inc.Hosting, runtime and storageUSA; global networkISO 27001, ISO 27701, PCI DSS, SOC 2 Type II
Anthropic PBCAI analysisUSASOC 2 Type II, ISO 27001:2022, ISO/IEC 42001:2023
Resend, Inc.Email deliveryUSASOC 2 Type II
Stripe, Inc.PaymentsUSAPCI DSS Service Provider Level 1, SOC 1 and SOC 2 Type II
Netlify, Inc.Website deliveryUSASOC 2 Type 2, ISO 27001, ISO 27018
Meta PlatformsWhatsApp Business PlatformUSA and IrelandHeld only until delivered
Google LLCDrive and Calendar, when connectedUSAUnder Google’s Limited Use policy
Accurate, KledoAccounting, when connectedIndonesiaTokens deleted on disconnect
Xero LimitedAccounting, when connectedNew Zealand; hosted in the USATokens deleted on disconnect
ElevenLabs, Inc.Voice for editorial audioUSAEditorial scripts only

Everything your procurement team needs

Send these to your security, legal and procurement teams. For anything more, write to privacy@pspsignaldesk.com and our team will answer.

Data processing agreement

How we process personal data on your company’s behalf: our duties, the security measures, every provider, breach notice and deletion. Ready to sign.

Download the agreement

Security questionnaire, answered

The questions security teams ask, answered in full: hosting, encryption, access, AI processing, backups, incidents and retention.

Download the questionnaire

Privacy policy and terms

The privacy policy, version 3.5, and the terms, version 2.0, that every subscription runs on.

Read the privacy policy

Country compliance

How we meet the data and business rules of each market we serve, with every provider and where it is.

Read country compliance

Start with your first AI tool today

It is free, and your results are ready the moment you add it.

Start freeBook a 15-minute check

New to AI? Start with the free PSP AI Quickstart

Which rules apply to your AI tools?
See a sample answerCompare the plans
Ask SignalDesk

How can we help?