Data handling
Which providers process the hosted service's data, where it is stored, how long it is kept and how it is protected. A self-hosted installation keeps everything on infrastructure its operator chooses, and none of this page applies to it. The privacy notice is the governing text; this page names the providers and periods it refers to. Questions and requests go to justin.pitt@execbound.ai.
Providers
| Provider | What it does | What it receives |
|---|---|---|
| Render | Runs the application and serves the websites | Every request to the service and every response, in transit |
| Supabase | Hosts the PostgreSQL database and its backups | All workspace data: accounts, settings, policies, credentials in the protected forms credentials describes, and the audit history |
| Delivers the service's email: sign-up links, invitations and notifications sent by email | The recipient's address and the message | |
| Anthropic | Answers the assistant, only in a workspace whose administrator has turned it on, and only when a person asks it something | The question and the records the assistant reads to answer it, with the asking person's own access |
| Google and GitHub | Sign-in, only for a person who chooses to sign in with one of them | What that provider returns about the person: an account identifier and an email address |
No provider receives workspace data for advertising, and the service embeds no third-party analytics. Optional aggregate analytics, when a person consents, are counted by the service itself.
Where data is stored
Workspace data and its backups are stored in the United States, in Virginia: the database in Supabase's us-east-1 region and the application on Render's Virginia region. No other region is offered today. Google, Anthropic and GitHub process what they receive in their own locations, under their own terms.
How long it is kept
| Data | Kept |
|---|---|
| A workspace's data, its audit history included | While the workspace exists, except as the rows below say. It is deleted within 30 days of a request to close the workspace or the account |
| The entries ExecBound keeps from a connected Microsoft Entra directory's own audit log | Removed once they are 30 days old, unless a finding cites them or a detection rule still reads them or may yet read them, as discovering agents in Entra describes. Findings, and the entries they cite, are kept while the workspace exists. The directory's own audit log is never changed |
| A connected Microsoft Entra directory's service principal sign-ins | Never kept. Each sign-in's address is matched to a platform's published egress, or to a Tines tenant's egress an administrator recorded, and discarded; only which platform drives which actor, with its first and last moment, is kept, beside the leading product token of the user agent, as who drives an actor describes. No sign-in address, name or identifier is stored |
| The email address on a sign-up request | Removed 30 days after the request is refused or expires, or 90 days after it is claimed, as the privacy notice says. The domain, the timestamps and the sign-up's progress remain |
| The assistant's questions and answers | Cleared from the workspace 30 days after each answer. The model provider keeps what it was sent for up to 30 days under its commercial terms |
| Copies in the database provider's backups | Until they age out on that provider's backup schedule, after the data itself is deleted |
| Hosting and request logs | On the hosting provider's schedule |
Service measures
The service measures its own operation from records it already keeps: how soon new workspaces reach a first governed decision, whether a second person decides an approval, whether workspaces still send governed requests weeks later, how long approvals take from notification to decision, how many lapse, and how often workspaces that start by observing switch to enforcing.
- Aggregates only. The measures are counts and medians across workspaces. They carry no workspace, person or account identifier, no name or address, and no request reference.
- Small groups withheld. Any figure drawn from fewer than five workspaces is withheld, and so is any figure that could be worked out from the ones shown.
- Opting out. A workspace where anyone has declined or withdrawn optional analytics is left out of every measure.
- Kept inside ExecBound. The measures are not stored as a series, published or shared outside ExecBound. No browser telemetry, pixel or link tracking is used to make them.
The privacy notice remains the governing text.
How it is protected
- In transit. Every page and every API is served over HTTPS. The application connects to the database over TLS that verifies the database's certificate and host name.
- At rest. The database provider encrypts stored data and backups. That is the provider's own statement about its platform, and ExecBound has not verified it independently.
- Credentials. A credential kept in the database is a digest, a public key, or encrypted with AES-256-GCM under a key held outside the database, and the credentials ExecBound uses to reach other services are kept in the deployment's private configuration, never in the database; where credentials live has every one. Beyond credentials, ExecBound does not encrypt workspace data itself, and it offers no customer-managed keys.
- Access. Each workspace's data is kept apart by row security in the database, which the threat model states and the acceptance inventory evidences.