Protect revenue. Release cash. Prevent disruption. Govern enterprise AI. Connect your organization and watch problems move from detected → verified in the Decision Queue. Start the 11-step connection wizard →

Data handling · v2026-02

What we do with your data. In plain English.

Every claim below is verifiable against the running codebase. If a line here cannot be substantiated by code or infrastructure contract, it must be removed.

Sample workspace

What is processed: Pre-generated synthetic rows only. No file upload accepted.
AI providers: None — no AI call is made on this scope.
Retention: Session-only cache in your browser; nothing persists on our servers beyond anonymous event names.
Deletion: Close the tab and the session is gone.
Who can access: Nobody — the sample workspace is fully anonymous. We don't collect your email, IP is not written to logs beyond the 30-day CDN access log that every public site keeps.

Upload pilot (opt-in, future)

What is processed: Only the fields marked required on the template you downloaded. Rows beyond 500 are truncated before processing. Any column we did not ask for is dropped at ingest.
AI providers: Anthropic Claude Sonnet 4.5 — used to generate the plain-English narrative for each detection. Model is called with field names and aggregated metrics only; raw row values are never sent as prompts.
Retention: 90 days by default; configurable to 24 hours in your workspace settings. Deletion is immediate and permanent — Mongo deleteMany with no soft-delete flag.
Deletion: One button: Workspace → Data → Erase uploaded data. Returns within 2 seconds.
Who can access: Only authenticated users in your workspace with the uploader role or higher. DuluthPath staff access requires a signed-support ticket with your explicit written consent.

Live connectors (QuickBooks, Salesforce, Dynamics 365, SAP S/4HANA, Epicor Kinetic, NetSuite)

What is processed: Objects you authorise, read-only by default. OAuth tokens are encrypted at rest with Fernet; the encryption key is held in Emergent-managed KMS, not in the application database.
AI providers: Anthropic Claude Sonnet 4.5 — same narrative-only pattern as above. No PII or row-level values are sent to the model.
Retention: Signal store 365 days; audit log hash-chained and retained for 7 years per SOC 2 scope.
Deletion: Revoke the connector in Authorizations → Connections. Encrypted tokens and all synced signals are purged within 60 seconds; the audit record of the revocation is retained.
Who can access: Only users in your workspace with the Connector-Admin role. Role grants are logged into the hash-chained audit trail.

Cross-cutting guarantees

Observe mode is the default on every new tenant — zero writes to your systems until you explicitly arm a writeback scope.
No uploaded business data is ever written to third-party analytics. We log event NAMES only (e.g. `upload.completed`), never payloads.
No ad or marketing cookie is dropped on the sample workspace. First-party, cookie-less event logging.
Hosting: application + database inside an Emergent-managed Kubernetes cluster. US-East region by default; EU region available for subscribers who require it in-contract.
Encryption: TLS 1.3 in transit, AES-256-GCM at rest for the Mongo cluster volume, Fernet for OAuth tokens.

Compliance posture — current state, not aspirational

· SOC 2 Type II: controls aligned; external audit scheduled Q4 2026. Not yet certified — do not represent us as certified.
· ISO 27001, HIPAA, PCI-DSS, GDPR: controls aligned. Certification status is disclosed on the Security & Compliance page as it changes.