Security and data handling

1What we hold

For each client company we hold only what the work needs:

• Account details for each person the company invites: name, work email and role.
• Files the company uploads, such as ledgers and management accounts.
• ERP data, when the company connects its ERP through a Pylon connector.
• Questions asked of Ask Pragmon AI, and the answers.
• The reports we write for the company, with the figures and sources behind them.
• A record of every sign-in, every refused access, and every opening or export of a report.
• Product analytics, and only after the person consents.

We also read more than 1,000 public outside sources. Those are not client data, and the shared market reports we build from them contain no client’s data. We do not sell data.

2Where it is stored

Client data lives on Railway, in a managed PostgreSQL database, a storage bucket and managed volumes. United States (Railway, US West).

The website and the web workspace are served through Vercel. Its region is available on request to security@pragmon.ai.

Transfers to the United States are covered by Standard Contractual Clauses in our vendor agreements. We do not offer a deployment pinned to the EU today.

3AI models

We use Anthropic Claude and OpenAI GPT through their business APIs, and Perplexity for research across public sources.

Nothing a client gives us trains any model, ours or a vendor’s. That covers uploaded files, ERP data, questions to Ask Pragmon AI, and every report we write. Anthropic and OpenAI do not train on our API traffic under their commercial terms.

Each of the two keeps a short abuse-detection window of up to 30 days under its published policy. We do not yet hold zero-retention terms.

4How long we keep it

• Uploaded files: kept while the account is live, and deleted on written request.
• Sign-in records: kept for 13 months. Error traces: 30 to 90 days. Product analytics: 12 months.
• Reports, questions and account details: kept while the account is live. Data under a legal hold is kept until the hold ends. When a contract ends, we delete or return the company’s data, at its choice, as GDPR requires of a processor (Article 28), unless the law requires us to keep it.

5Deletion and export

A client can ask us to export or delete its data at any time, in writing. There is no self-serve button today: our team agrees the scope, format and timing, runs each request, and asks our processors to purge what they hold. We act on each request within one month, as GDPR requires (Article 12).

When a client leaves, we return its data on request and delete it under a written plan agreed with that client.

6Who can reach it

Each company is walled off. Every request is checked against the user’s membership of that company before any data comes back, so one client can never see another’s figures.

• Roles are set per company: Owner, Admin, Member and Viewer.
• People sign in with a password or a one-time email link. Passwords are stored hashed. Sessions end after 12 hours, and repeated failed attempts are blocked.
• Our own access is a separate tier, held by a small named team.
• Single sign-on Planned
• Passkeys Planned

7Encryption

• In transit: TLS 1.2 or higher on every connection, and the site enforces HTTPS.
• Passwords: stored hashed.
• ERP passwords: stored encrypted.
• At rest: details of encryption at rest are available on request to security@pragmon.ai.

8Backups

The database runs on Railway’s managed PostgreSQL, with the backups Railway manages. Details of backups are available on request to security@pragmon.ai.

9Incidents

Errors go to Sentry, and service health and redacted logs to Better Stack. Logs carry no request bodies, cookies or authorisation headers. Our team is alerted in Slack.

If we confirm an incident affecting a client’s data, our target is to tell that client within 24 hours of becoming aware. Where we are the controller and individuals are likely to be at risk, the competent supervisory authority is notified within 72 hours.

10Certification

We hold no certification today and have no penetration test on record.

• SOC 2 Planned
• Independent penetration test Planned

We complete security questionnaires and data processing agreements for every client. Send yours to security@pragmon.ai.

Sub-processors

Fifteen providers process data on our behalf, each receiving only what its function needs. Changes to the list are notified. If a client connects its ERP, that connection is to the client’s own system and is recorded on its contract.