Does your data train AI?
No. We do not train AI models on your data, and the AI companies we pay are barred by contract from doing so.
We send an AI service only what a task needs, such as the text being checked, and we use paid business accounts whose terms forbid training on what we send.
Turning customer video into text is switched off today. Before we turn it on with any company, we check that it neither trains on nor keeps your audio.
| AI service | What we use it for | Trains on your data? | How long they keep it |
|---|---|---|---|
| Anthropic (Claude) | Drafting, brand checks, photo checks, brand questions | No | Deleted within 30 days |
| Your own AI account | Only if you connect one | Your agreement with that company decides | We recommend a paid plan: some free plans train on what you send |
Where your data lives
Everything is stored in the United States. AI services may process a request outside the US unless set to US-only. We do not offer an EU region today.
| Data | Provider | Location | Kept |
|---|---|---|---|
| Database and files | Supabase on Amazon Web Services | us-east-1, N. Virginia | Until you delete it, then 30 days in Recently deleted before it is removed for good |
| Application | Vercel | iad1, Washington, DC | Nothing kept between requests |
| Daily backups | Supabase | us-east-1, N. Virginia | 7 days |
| Weekly off-site copy | Cloudflare R2, a second company under a separate login | Being confirmed | Deleted items are removed from it within 90 days of being deleted |
| Resend | United States | Per Resend's terms |
Subprocessors
Companies that process your data so we can run our service. We post changes here at least 30 days before a new one starts, and you can object.
| Company | Purpose | Data | Location |
|---|---|---|---|
| Supabase, Inc. | Database, sign-in, file storage, backups | All stored data | US |
| Vercel Inc. | Hosting the app | All traffic | US |
| Cloudflare, Inc. | Off-site backup | A copy of stored data | Being confirmed |
| Resend | Names, addresses, email content | US | |
| Anthropic, PBC | AI drafting and checking | The text and images a task needs | US storage; processing global unless set to US-only |
Some features use other services, such as Cal.com for booking calls and Slack for alerts to our own team. Services you connect to your own accounts (social, CRM, website, your own AI) follow your agreement with them. Ask us for the full list.
Security controls in place
Encryption
In placeHTTPS everywhere. Data, files and backups are encrypted at rest. Account tokens you connect are encrypted again by us.
Customers kept apart
In placeEvery database table has row-level security switched on and closed by default. Automated tests check that one client cannot see another's data.
Tamper-evident activity log
In placeEach entry is chained to the one before it, so a changed or removed entry shows. The check shows one break, from entries removed on July 30, 2026; we are recording it openly and locking the log against changes. Admins can export it.
Permissions
In placeSet per person. Risky actions need a senior admin and a typed confirmation.
Backups
In placeDaily backups, plus a weekly copy at a second company under a separate login.
Release control
In placeEvery release goes through a preview first and traces to an exact code version.
What we are adding
We would rather tell you than have you find out.
Single sign-on and user provisioning
Being builtSAML sign-in and SCIM to add and remove users automatically.
Two-step login
PlannedFor password sign-in.
Independent penetration test
PlannedSummary shared under NDA.
SOC 2 report
PlannedType 1 first, then Type 2. Our hosting providers already hold SOC 2 Type 2.
Written incident response plan
PlannedWith a practice drill.
Full data export
PlannedAvailable on request until then.
Documents
Available on request. Write to security@infinitusmc.com.
Contact
Security and privacy questions, or to report a vulnerability: security@infinitusmc.com