Everything a security review usually asks for, on one page: where your data is hosted, how it is protected, what the AI is allowed to do with it — and the published documents that make those commitments binding.
CustomerEagle's primary hosting is in the EU. AI processing can take place outside the European Economic Area, including in the US. Our DPA names each provider, its processing location and the safeguards we describe for it.
Data moving between the widget, your dashboard, our service and any connected integration travels over TLS. Stored credentials and sensitive personal data are encrypted at rest with AES-256-GCM, and backups are encrypted too.
CustomerEagle is multi-tenant, and the separation is enforced in the application: every query that touches customer data is explicitly scoped to a single workspace. PostgreSQL row-level security is configured behind that as a defence-in-depth layer — a second net, not the thing we lean on.
You can read what you are agreeing to before you agree to it. The Data Processing Agreement carries the Article 28 terms, the sub-processor list and the transfer clauses; the privacy policy sets out what we process and why; deletion is self-service and documented.
The assistant answers from sources you approved and cites them; when it is not confident, it hands the conversation to your team instead of guessing. Your support data is never used to train general models.
Our technical and organisational security measures are contractually committed in a public Data Processing Agreement — published for review before you sign, not available on request. The DPA names every sub-processor with its purpose and processing location, and it may only be updated if the level of protection is not materially reduced. If your procurement runs on a security questionnaire, the published documents answer most of it — and we answer the rest directly.
If you think you have found a security issue, tell us before you tell anyone else. Use the contact form and say in the first line that it is a security report — our team replies within one business day. Our terms ask for the same courtesy in writing: a reasonable opportunity to investigate and remediate before anything is disclosed publicly.
Read the documents
We publish the legal texts rather than summarising them. The DPA carries the Article 28 terms, the full sub-processor table with processing locations, and the international-transfer clauses.
We'll email the current Data Processing Agreement and subprocessor list.
Try Professional free for 30 days, with Support and Sales in one workspace. Add Marketing when you’re ready.
Filling in a security questionnaire about us? The DPA and the privacy policy answer most of it — anything they don't, ask. Contact the team