Where it lives
United States infrastructure, primary region us-east-1 with encrypted backups in us-west-2. Nothing is replicated outside the region. Tenant metadata sits in managed Postgres; OAuth refresh tokens sit in a separate KMS-encrypted store with a distinct key.
In transit: TLS 1.3 · At rest: AES-256, backups included · Token store: dedicated KMS key, rotated every 90 days
How isolation works
Every record is scoped to the workspace that produced it, and every query is scoped to the account that owns that workspace. An MSP portfolio view is an aggregate over the workspaces belonging to that MSP account and cannot reach any other account's data. There is no shared analytics pool across customers.
Who can see it on our side
Nobody has standing production access. Access is granted just-in-time, time-boxed, requires SSO with a hardware key, and is logged. We will produce the access log for your tenant on request.
What happens when a token expires
Silent token expiry is the failure mode that quietly zeroes out a report, so we treat it as an incident rather than a state. The connection is marked as needing re-auth, the numbers it fed are flagged as stale on the integrations page and the dashboard, and whoever connected it is alerted.
We would rather show you a gap than a confident wrong number.
Deleting everything
Company settings → Workspace → Delete workspace. That revokes every connection, removes stored metadata within seven days including backups, and we confirm in writing. There is no retention hold and no exit fee. Revoking consent in your admin console stops new reads immediately, independently of this.
Entra: admin center → Enterprise applications → &License Discovery → Delete · Google: admin console → Security → API controls → App access control → &License → Remove