Security

The short version

Your spreadsheet is analyzed by Python running inside your own browser tab. Files you choose to save are stored on our servers, and the text of each AI request, with any data you attach, goes to the model provider you select (section 6). Platform connectors are not live yet; when they launch, their credentials will be held where no browser client can read them, including yours. You can delete everything we hold for you, yourself, in one action. Below is the detail, including what we have not done yet.

1. Analysis runs in your browser

The Analyst writes Python and executes it in your browser via WebAssembly. For file-based analysis, the contents of your spreadsheet are computed locally. The numbers you see are produced on your machine. This is why you add no tracking pixel and migrate no data: the computation goes to the data. Files you explicitly save to your workspace are uploaded and stored; ad-hoc analysis need not be.

2. Connector credentials

Direct connectors for Shopify, Meta, Google Ads, GA4, Klaviyo and Google Sheets are not live yet. Today you upload the export you already download from each platform.

When connectors launch, the tokens they create will be written to a private, server-only location (users/{uid}/private/connections) that our security rules deny to every client, including the account that owns it. Only server code will hold the key. Your profile will carry a non-secret marker recording that a connector is present, so the dashboard can show "connected" without the credential traveling to the browser. Earlier builds stored these as ordinary profile fields, which meant they were readable by the signed-in browser; that was changed and the old fields are removed by migration.

3. Least-privilege scopes

Reporting connectors will request read scopes. Where a scope would grant write access we will ask for it only if the feature needs it, and where our own copy promises "recommend only, you approve every move", the connector is read-only by design. If you want to see a specific scope before connecting, ask us and we will tell you exactly what is requested and why.

4. Authentication and isolation

Accounts are authenticated by Firebase Authentication, with Google SSO or email and password. Every stored document and file is scoped to your user id and enforced by server-side security rules; client code does not decide access. Those rules are covered by an automated test suite that runs against a local emulator on every check, so a rule change that would widen access fails the build before it can ship.

5. Encryption and location

All traffic is HTTPS/TLS. Data at rest is encrypted by Google Cloud. Storage and processing are in the United States.

6. Subprocessors

Google Cloud Platform and Firebase (hosting, authentication, database, file storage). Anthropic, OpenAI and Google for model inference. The model you select determines which one receives your prompt. Stripe for payments; we never see or store your card details. Email delivery for transactional messages. Model providers receive the text of your request and the data you attach to it; they do not receive your credentials.

7. Deleting your data

Settings → Privacy → "Delete all my data" erases everything we hold for you: datasets and their files, saved reports, API keys, connected stores and any benchmark contribution, and it disables your login. Deletion is immediate and permanent. There is no soft-delete tier that we retain. You do not need to contact support to do this.

8. What we do not have yet

We are not SOC 2 or ISO 27001 certified, and we will not imply otherwise. We do not currently publish a status page or run a formal bug bounty. We are a young company and these are on the roadmap. They are not in place today. If your procurement process requires a completed security questionnaire or a signed DPA, contact us and we will complete it honestly, including the gaps on this list.

9. Reporting a vulnerability

Email security@bizfalconai.com with enough detail to reproduce the issue. We will acknowledge it, tell you what we found, and tell you when it is fixed. Please do not test against other people's accounts or data.