Data security

Your accounts. Our access. Every rule, written down.

The page for whoever in your company asks "wait — who exactly gets access to what?" Short answers first, details below.

01
NDA before anything

Signed before a single account is shared. Yours or ours — signed within one business day.

02
Read-only, scoped, logged

Viewer/analyst roles only, limited to the accounts in scope. We never hold admin rights and never make changes.

03
Gone at handover

Access revoked at readout; working data deleted within 30 days. Never used to train AI models.

The data flow, end to end

Four steps. No copies left behind.

01 · YOUR ACCOUNTS

You grant viewer/analyst roles from your side — we never hold your passwords.

02 · READ-ONLY PULL

Scoped API reads of the accounts in scope — aggregates and reports, never customer PII.

03 · EU PROCESSING

Agents run inside EU infrastructure; a senior auditor reviews before anything advances. Nothing trains AI models.

04 · REVOKE + DELETE

Access revoked at your readout; working data deleted ≤ 30 days after close. You can verify both.

What we access, exactly
Systems accessed during the audit, the access level and what each is used for
SystemAccess levelUsed for
GA4 / analyticsViewerFunnel & attribution
Meta / Google AdsAnalyst (read-only)Spend efficiency
Email / CRM (e.g. Klaviyo, HubSpot)Read-onlyLifecycle coverage
Revenue (e.g. Shopify, Stripe, exports)Reports onlyMargin verification
Customer PIINever requestedAggregates only
Processing & compliance
All processing within the EU CCPA & GDPR ready · DPA available Your data never trains AI models Subprocessor table below · full list with the DPA Working data deleted ≤ 30 days after close
Subprocessors

Who touches the data, and under what terms.

Subprocessors — who touches the data and under what terms
SubprocessorPurposeLocationSafeguard
Netlify, Inc.Website hosting & form intakeGlobal CDN / USDPA + SCCs
Zoho CorporationCRM — lead & client recordsEU (crm.zoho.eu)DPA + SCCs
Google (GA4) & Microsoft ClaritySite analytics (consent-gated)EU / USDPA · consent-mode gated
Google WorkspaceReport delivery & client communicationEU / USDPA + SCCs

Current as of Jul 2026 · changes announced 30 days ahead to active clients · the full legal list ships with the DPA.

Security cleared? Let’s find your margin.

Fixed fee. 5–7 days. $10k–$50k of findings, or your money back.

Find my leaking margin