We read. We never write. And your data stays yours.

Access

• Every connection is read-only. We never ask for, store or use anyone's password.
• Your admin creates each key, connected app or export, and can switch it off at any time without asking us.
• Credentials are stored encrypted and are used only by the scheduled sync for your account.
• We keep a connection log for every client: system, method, who created it, and how to revoke it.

Where your data lives

• Each client has a separate database. No shared tables, no pooled data across clients.
• Data is encrypted in transit (TLS) and at rest by our infrastructure providers.
• On request, we build inside your own cloud account so the data never leaves your environment.
• Daily backups with point-in-time restore.

What we collect, and what we don't

• Totals and record IDs are enough for almost every metric. We don't need customer, student or donor names, emails or phone numbers to count them.
• We pull only the fields your metrics use, and we list them in your scope.
• We don't take on work involving patient health information.
• For schools, we work from aggregate counts and pseudonymous IDs and review FERPA obligations with your compliance lead before connecting anything.

Console sign-in

• Named user accounts only. No shared logins.
• Multi-factor authentication is required for owners, admins and our own staff.
• Hardened session cookies, idle timeouts, and lockouts on repeated failed sign-ins.
• Email notices for password changes, MFA changes and sign-ins from a new device.
• An audit log of who viewed what, and when.
• Location-limited access for branch managers and franchisees.

People and process

• Access to client data is limited to the people working on your account.
• Every change to a metric rule or dashboard is recorded in your change log.
• We confirm every new connection with you in writing before the first sync.

Retention and deletion

• You can export your data at any time.
• When an engagement ends, we delete your database and revoke our access within 30 days, and confirm it in writing.
• Deletion on request at any time, for a single source or for everything.

Incidents

• We notify you without undue delay, and within 72 hours, if we become aware of a security incident affecting your data.
• Notices explain what happened, what data was involved and what we are doing about it.

Certifications

• We don't claim certifications we don't hold. Instead, we complete your security questionnaire, share this page and our Data Processing Addendum, and answer every question in writing.

Documents

Our Data Processing Addendum is part of every client agreement. Security questions go to [email protected]; to report a vulnerability, use the same address with "Security" in the subject line.