Security

The web application uses Clerk for account authentication and session management. Decisionate does not store your sign-in password. Protected API requests verify authentication tokens and resolve the signed-in identity before checking workspace access. Browser controls are not the sole authorization boundary.

Protect your account, use the security options available from your identity provider, and sign out on shared devices. Report suspected account misuse to support promptly.

Private datasets, connections, decisions, analysis, preferences, and related records are checked against the active workspace and the user's membership and role. A workspace ID supplied by a browser is not permission to access that workspace. Agency-managed client workspaces have separate access checks, and platform administration requires a separate role.

Report-job access is scoped to the submitting user and workspace, with dataset permission checks when jobs are retrieved. Saved reports also require access to their source datasets. Date and dimension filters narrow analytical inputs; they are not access controls or anonymization. Selected unique values, labels, and small groups can identify people.

Owners control member access and sharing. An intentionally enabled public dashboard link is an exception to private sign-in: anyone with a valid link can view its shared information. Revoke links that are no longer needed. The public live demo and recorded walkthrough contain prepared sample data, not customer workspace records.

In production mode, stored OAuth access and refresh tokens use application-level Fernet encryption. Sensitive connector configuration and platform email secrets use the supported secret-protection paths. Usable credentials are excluded from normal connection responses. Production mode requires a valid secret-encryption key and fails startup when required protection is missing.

Use minimum-scope provider permissions and read-only database accounts where supported. Database imports validate read queries; that validation does not replace a properly restricted database account. Connector imports are analytical inputs, not authorization to edit provider source records. Removing a connection removes its stored credentials but does not delete datasets already imported through it.

Where date-based imports are supported, the initial sync requests 90 days before older available history is loaded in checkpointed background chunks, up to three years. Chunking reduces work per import and supports resumption; it does not extend provider permissions or history coverage.

In production mode, the API validates required token-verification settings, encryption-key configuration, HTTPS application and API URLs, explicit allowed web origins, PostgreSQL, remote S3-compatible object storage, and error-monitoring configuration. It refuses to start if those checks fail. Development configurations are not production guarantees.

Dataset files use configured object storage and database records use the configured database. Provider access controls, encryption of database volumes or backups, region selection, and backup recovery depend on the deployment and provider settings. We do not claim end-to-end encryption of analytical data or immediate erasure from every backup.

Report relationship analysis, report anomaly checks, and weekly report processing use a separate analysis worker and durable database jobs. Job records contain submitted settings, source references, status, and results; closing the browser does not delete them. Saved report definitions and result snapshots are also database records, not just temporary browser content. Separate processing is not by itself a security sandbox; it relies on the configured application, hosting, database, and storage access controls.

AI analysis sends bounded aggregate facts, selected context, and relevant user-authored decision learning to the configured provider. Such text can contain personal information, so avoid secrets and unnecessary sensitive details. Requested report interpretation can include business questions, selected dimension filter values, and bounded unusual-change and seasonal-analysis results. These summaries are not an upload of the raw dataset file or every source row, but they should not be assumed to be anonymous. Outputs require human review and do not automatically execute business actions.

Stripe handles supported checkout and payment-card information; full card numbers are not stored in Decisionate. Payment and subscription updates use verified provider events rather than trusting a browser success message.

The application includes request-size controls, rate limiting, background ingestion jobs, operational checks, and workspace activity records for supported actions. API error monitoring disables default personal-information collection, local-variable capture, and request-body capture. Error context and operational metadata may still be processed for diagnosis.

Report processing has per-workspace queue limits, bounded metric and lag-test counts, and supervised execution timeouts. During execution, the worker rechecks workspace access, source versions, and weekly delivery settings where applicable; detected changes can stop work and require a fresh preview. Interrupted email delivery is not blindly resent: delivery history and provider logs must be checked before retrying. These controls do not guarantee uninterrupted availability or exactly-once email delivery.

Automated tests cover authentication, workspace permissions, credential protection, retention, and production configuration. These checks are not a security certification, an independent penetration-test report, or a guarantee that no vulnerability exists. Security also depends on deployment settings, provider access, and ongoing operational review.

Connector data is kept for three years, then deleted. The live retention window covers a rolling three calendar years, enforced during sync and scheduled maintenance. This rule does not automatically delete manually uploaded datasets, decisions, or account settings.

Finished analysis-job records are eligible for cleanup after seven days, or 90 days for weekly-send jobs. This cleanup runs while the analysis worker operates and does not delete saved report snapshots or copied decision evidence. Authorized deletion of a saved report removes its associated saved-report job records but preserves source datasets and linked decisions, including copied evidence. Deleting the report used as the weekly template also removes that template and pauses delivery; removing only the template keeps the saved report. Deletion and revoked sharing do not recall previously downloaded files or delivered emails.

After trial or subscription expiry, analytical dataset storage becomes eligible for deletion 89 days after the subscription end date, or 90 days after a recorded cancellation, whichever applicable deadline is earlier. Scheduled lifecycle processing removes dataset files and associated records, analyses, joins, and shares, including governed agency client workspaces. Connection settings and credentials are not removed by that analytical purge. Renewal does not restore deleted data.

Authorized workspace deletion removes supported live workspace records and files. Backups, replicas, provider source records, and records needed for legal or service purposes can have different retention cycles. Details are in the Privacy Policy and Terms of Service.

Available product exports follow workspace permissions; supported decision exports are restricted to workspace owners. Raw connector rows and files are not offered as a separate source-data download service. Product permissions do not limit an individual's applicable right to access, correct, or request deletion of their personal information.

Contact support for a privacy request or for deployment-specific provider, location, or security information. We verify identity and authority before releasing or deleting information and protect other people's data.

Email support@decisionate.ca with the affected feature, approximate time, and a description of the issue. Include only the minimum evidence needed; do not send passwords, access tokens, full payment-card details, or unnecessary customer records. Do not access other users' data or disrupt the service while investigating.

We review reported concerns and communicate about relevant remediation and privacy obligations. This page does not promise a fixed incident response time or an uptime service-level agreement.