Security
Your figures stay yours.
Each company sees only its own data, and we never train AI on it.
Last updated 19 October 2026
Where each control stands today
Four live, four planned. We show a control as live only once it runs.
- Encryption in transitLive
- Company-level access controlLive
- Sign-in protectionLive
- Audit of sign-ins and report accessLive
- Single sign-onPlanned
- PasskeysPlanned
- Independent penetration testPlanned
- SOC 2Planned
Your data and AI
We never train AI on your data.
Nothing you give us trains any model, ours or a vendor’s.
Anthropic and OpenAI do not train on our API traffic under their commercial terms.
None of this trains a model
- Files you upload
- Data from your ERP
- Your questions to Ask Pragmon AI
- Every report we write for you
Main controls
How each company is kept apart
Seven controls run today, for every client and every user.
Each company walled off
Every request is checked against the user's membership of that company before any data comes back.
Roles per company
Owner, Admin, Member and Viewer, set for each company you work in.
Sign-in
Password or a one-time email link. Passwords are stored hashed. Sessions end after 12 hours, and repeated failed attempts are blocked.
Encryption in transit
TLS 1.2 or higher on every connection, and the site enforces HTTPS.
ERP passwords encrypted
The passwords that connect us to your ERP are stored encrypted.
Audit trail
Every sign-in, every refused access, and every opening or export of a client report is logged. Sign-in records are kept for 13 months.
Staff access
Staff access is a separate tier, held by a small named team.
Privacy
You own your data.
What we keep, what we delete, and what we never do with it.
Your data stays only while your account is live.
Shared market reports contain no client's data.
We do not sell data.
Product analytics run only after consent.
Changes to our sub-processors are notified.
Export and deletion on request, run by our team today. We act on each request within one month, as GDPR requires (Article 12).
Security questionnaires
Send us yours.
We complete security questionnaires and data processing agreements for every client.
Security and data handling
The plain-text version for your IT and legal teams: what we hold, where, for how long, and every sub-processor.
Last updated 19 October 2026
Read the pageQuestions
What security teams ask us
Where is my data stored?
On Railway, in a managed PostgreSQL database and storage. United States (Railway, US West).
Do you train AI on my data?
No. Nothing you give us trains any model, ours or a vendor's.
Which AI models do you use?
Anthropic Claude and OpenAI GPT through their business APIs, and Perplexity for research across public sources.
Can another client see my figures?
No. Every request is checked against the user's membership of that company before any data comes back.
Is data encrypted at rest?
Details of encryption at rest and backups are available on request to security@pragmon.ai.
Do you support single sign-on?
It is planned. Today you sign in with a password or a one-time email link.
Are you SOC 2 certified?
Not yet. It is planned.
What happens to my data if we leave?
We return it on request and delete it under a written plan agreed with you.
