Trust & Security

This page describes what information beluuga.ai holds and how we protect it. For detailed documentation or answers to your security questionnaire, contact hello@beluuga.ai.

1. Data we hold

• Account details: company name, name, and email address
• Content you create or save: DCF and LBO models, comparable company analyses (Comps), precedent transaction analyses (Deal Comps), folders, watchlists, deal records, and uploaded files
• AI chat inputs and responses
• We never hold credit card numbers. Payments are processed by Stripe, which stores all card data.

2. Where data is processed and stored

• The application runs in Vercel's Tokyo region.
• Databases and files are stored in Supabase's Tokyo region (AWS ap-northeast-1).
• Databases are backed up daily to multiple locations.

3. Encryption

• All traffic is encrypted with TLS, and HSTS ensures connections are made over HTTPS only.
• Data at rest is encrypted with AES-256 by our database provider (Supabase).
• Excel add-in connection tokens are stored only as hashes.

4. Access control

• Row-level security in the database isolates each customer's data by tenant. No customer can see another customer's data.
• Two-factor authentication is required for all paid accounts.
• Sign-in is protected by bot detection.
• Our internal admin console requires both administrator privileges and two-factor authentication.

5. AI processing — never used for training

• To run AI features, your input and related company data are sent to Anthropic's Claude API.
• We never use your input to train AI models. Under Anthropic's commercial API terms, data sent through the API is not used for model training either.
• Input screening blocks prompt-injection attempts, and usage is rate-limited.

6. Retention and deletion

• AI chat logs are kept for abuse detection and quality review, and are deleted automatically every day once they are older than 90 days.
• When you cancel, your data is deleted within 30 days of the cancellation date.

7. Subprocessors

• Vercel Inc. (US): application hosting (Tokyo region)
• Supabase Inc. (US): database, authentication, and file storage (Tokyo region)
• Anthropic PBC (US): AI processing
• Stripe, Inc. (US): card payments
• Resend, Inc. (US): email delivery
• Cloudflare, Inc. (US): bot detection at sign-in
• Render Services, Inc. (US): company profile generation
• GitHub, Inc. (US): scheduled jobs
• Google LLC (US): backup storage
• Microsoft Corporation (US): backup storage

8. Incident response

• We maintain a written incident response procedure.
• If a personal data breach occurs, we aim to file an initial report with Japan's Personal Information Protection Commission within 72 hours of becoming aware of it, and we notify affected customers promptly.

9. Certifications

• We do not yet hold third-party certifications such as SOC 2 or ISO/IEC 27001 (ISMS). We are preparing to obtain them, and in the meantime we are happy to complete your security questionnaire.

10. Contact

• To report a security issue or vulnerability, contact hello@beluuga.ai.