Security & data protection

Encryption

• In transit: all traffic is served over HTTPS (TLS 1.2 or higher) with HTTP Strict Transport Security, so browsers never connect over plain HTTP.
• Secrets at rest: every credential we hold for you (connection tokens, API secrets, saved-card tokens) is encrypted at the application level with AES-256-GCM before it's written to the database. The key is kept separately from the data, as a server secret.
• Database: the database runs on a private network and is reachable only by the application, not from the internet.

Organization isolation & access control

• Every workspace, connection, skill and usage record belongs to exactly one organization. Access is checked on the server on every request; one customer can never see another's data.
• Roles: admins manage connections, team and billing; members see only the workspaces they've been given. Connecting or changing data sources is admin-only.
• Sign-in is through Google (OAuth 2.0 / OpenID Connect). We never see or store passwords. Sessions use signed, HTTP-only, secure cookies.
• Sensitive actions (connections, plan changes, approvals, deletions) are written to an activity log.

Least privilege on your accounts

• We request read-only access to ad, analytics and e-commerce accounts wherever the platform allows it.
• The assistant can't change your ad accounts on its own. Campaigns are prepared as drafts, created only after a person approves them, and always start paused.
• You can revoke access at any time, from the Integrations page or from the platform's own account settings; tokens we hold for a removed connection are deleted.

Application security

• Security headers on every page: Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
• AI-generated dashboards run in a sandboxed frame with no access to your session, cookies or the rest of the app.
• Shared dashboard links are long random tokens, read-only, and can be revoked (rotated) at any time.
• Webhooks from third parties are verified (signatures, or by re-reading the result from the provider) before we act on them.
• Dependencies are pinned to exact versions and kept up to date.

AI and your data

• Your data is never used to train AI models, ours or anyone else's. We use the business APIs of our AI providers, whose terms exclude training on customer data.
• The assistant receives only what it needs to answer the current request. Providers may keep request data for a short period for abuse monitoring, as described in their policies.
• Data from Google APIs is handled under Google's Limited Use requirements (see the Privacy Policy).

Payments

Payments are processed by a PCI DSS–compliant payment provider. Card details are entered on the provider's secure page and never pass through or get stored on our servers. We keep only a provider token (encrypted), the card's last four digits and its expiry month, to renew your subscription.

GDPR & privacy law

Bamboo Insights is built to meet the EU General Data Protection Regulation (GDPR), the UK GDPR and Israel's Protection of Privacy Law (including Amendment 13):

• Roles: for the business data you bring into the service we act as your processor, under our Data Processing Agreement. For your account and billing data we are the controller.
• Data rights, built in: anyone can download all their data or delete their account from Account & privacy in the app; admins can delete their whole organization. Other requests are handled within 30 days.
• Minimization: from e-commerce sources we keep store-level totals, not individual customers' names, emails or addresses.
• Transfers: where data leaves the EU/EEA or Israel, transfers rely on adequacy decisions or the European Commission's Standard Contractual Clauses with our providers.
• Cookies: we use only strictly necessary cookies (sign-in session and your chosen organization). No advertising or tracking cookies.

“GDPR ready” describes the measures on this page. It is not a certification; GDPR has no official certification badge. We don't yet hold third-party certifications such as SOC 2 or ISO 27001.

Retention & deletion

• Chats and Library files are kept until a member of the workspace deletes them; deleting the workspace, organization or account removes them.
• Everything else is kept while your account is active. Deleting a workspace, an organization or your account removes its data from our active systems right away.
• Disconnecting an e-commerce store deletes its stored data immediately; unclaimed installations are deleted after 30 days.
• Payment records and invoices are kept as required by tax law, detached from deleted organizations.

Incident response

If we become aware of a personal-data breach affecting you, we notify affected customers without undue delay, and within 72 hours where the law requires, with what happened, what data was involved and what we're doing about it. We also notify the relevant authorities where required.

Subprocessors

We use a small number of trusted providers to run the service. Each is bound by a data-processing agreement.

Report a vulnerability

Found a security issue? Email [email protected] with “Security” in the subject. We respond within 2 business days, keep you updated, and won't take action against good-faith research that avoids privacy violations and service disruption.