Legal

Security

Last updated: August 27, 2026

The short version

Your spreadsheet is analysed by Python running inside your own browser tab, not on our servers. Connector credentials are held in a location no browser client can read — including yours. You can delete everything we hold for you, yourself, in one action. Below is the detail, including what we have not done yet.

1. Analysis runs in your browser

The Analyst writes Python and executes it in your browser via WebAssembly. For file-based analysis, the contents of your spreadsheet are computed locally — the numbers you see are produced on your machine. This is why there is no pixel to install and no data migration: the computation goes to the data rather than the reverse. Files you explicitly save to your workspace are uploaded and stored; ad-hoc analysis need not be.

2. Connector credentials

When you connect Shopify, Meta, Google Ads, GA4, Klaviyo or Google Sheets, the resulting tokens are written to a private, server-only location (users/{uid}/private/connections) that our security rules deny to every client, including the account that owns it. Only server code holds the key. Your profile carries a non-secret marker recording that a connector is present, so the dashboard can show "connected" without the credential travelling to the browser. Earlier builds stored these as ordinary profile fields, which meant they were readable by the signed-in browser; that was changed and the old fields are removed by migration.

3. Least-privilege scopes

We request read scopes for reporting connectors. Where a scope would grant write access we ask for it only if the feature genuinely needs it, and where our own copy promises "recommend only, you approve every move", the connector is read-only by design. If you want to verify a specific scope before connecting, ask us and we will tell you exactly what is requested and why.

4. Authentication and isolation

Accounts are authenticated by Firebase Authentication, with Google SSO or email and password. Every stored document and file is scoped to your user id and enforced by server-side security rules, not by client code. Those rules are covered by an automated test suite that runs against a local emulator on every check, so a rule change that would widen access fails the build rather than shipping quietly.

5. Encryption and location

All traffic is HTTPS/TLS. Data at rest is encrypted by Google Cloud. Storage and processing are in the United States.

6. Subprocessors

Google Cloud Platform and Firebase (hosting, authentication, database, file storage). Anthropic, OpenAI and Google for model inference — the model you select determines which one receives your prompt. Stripe for payments; we never see or store your card details. Email delivery for transactional messages. Model providers receive the text of your request and the data you attach to it; they do not receive your credentials.

7. Deleting your data

Settings → Privacy → "Delete all my data" erases everything we hold for you: datasets and their files, saved reports, API keys, connected stores and any benchmark contribution, and it disables your login. Deletion is immediate and permanent — there is no soft-delete tier we quietly retain. You do not need to contact support to do this.

8. What we do not have yet

We are not SOC 2 or ISO 27001 certified, and we will not imply otherwise. We do not currently publish a status page or run a formal bug bounty. We are a young company and these are on the roadmap rather than in place. If your procurement process requires a completed security questionnaire or a signed DPA, contact us and we will complete it honestly — including the gaps on this list.

9. Reporting a vulnerability

Email security@bizfalconai.com with enough detail to reproduce the issue. We will acknowledge it, tell you what we found, and tell you when it is fixed. Please do not test against other people's accounts or data.