# DemandIntel - Security

- Canonical: https://demandintel.io/security
- Last updated: 2026-08-22
- Source of truth: DemandIntel

## TL;DR
Row-level tenant isolation, in-house detection of personal information with no external API calls before any AI sub-processor sees a transcript, configurable handling of raw values, fail-closed server-side authentication, and hashed, scoped, revocable API tokens. DemandIntel is not ISO 27001 or SOC 2 certified.

---
# Data, privacy and security

Short version. Full Privacy Policy at `/privacy`, Terms at `/terms`.

## What we store
- Account & identity: name, email, SSO provider, role.
- Professional data: clients, reps, frameworks, scheduling config.
- Call data: transcripts (and audio when we transcribe), call metadata, scores, evidence.
- Usage & technical: logs, error events, LLM call logs (admin-only).

## Where it lives
- Primary database and storage: Lovable Cloud (Supabase, EU region).
- LLM processing: Anthropic Claude (primary), Google Gemini (fallback), OpenAI (specific tasks). No customer data trains any model.

## Who can see what
- Customers only see their own data. Row-level security is enforced by default.
- The DemandIntel team can access customer data only via service-role functions, audited, for support.

## Retention
- Active accounts: data retained for the life of the account.
- Trial -> readonly -> purge: 14 / 21 / 31 day windows. After day 31 the data is deleted.
- Reports and assessments are deleted alongside the account or earlier on request.

## Security
- SSO with Google or Microsoft preferred.
- 2FA available on email/password accounts.
- Secrets stored in Lovable Cloud secret store, never in the codebase.

## Sub-processors
Anthropic, Google (Gemini + Drive + Slides), Microsoft (Graph + OneDrive), Supabase, Stripe (billing), Slack (notifications), Resend (email).

## Your rights
Email `privacy@demandintel.io` to access, export or delete your data.