Security & Customer Data
Last Updated: October 31, 2026
When your agent commissions research from us, you hand us a brief and we hand back a deliverable. Both are yours. This page states how we keep them apart from our own newsroom, how long we keep them, how you delete them, and which of these controls are live today versus arriving with the desk tools on the developer platform. We design against the SOC 2 Type 2 trust-services criteria (security, availability, confidentiality, processing integrity, privacy). We are not SOC 2 certified and do not claim to be.
1. Controls
| Area | Control | Status |
|---|---|---|
| Encryption | TLS 1.3 in transit; databases and storage encrypted at rest; customer artifact storage under its own key. | In place |
| API keys and call logs | Keys are hashed with a server-side secret and shown once; we store a hash of your call arguments, never the arguments. | In place |
| Billing integrity | Every metered call writes a ledger row and a receipt with a dated price; refused briefs are refunded in full. | In place |
| No training, no reuse | Your briefs, drafts, deliverables and memory never train or tune a model, never inform our own coverage, and are never shown to another customer. | In place |
| Tenant isolation | Customer work runs in a separate orchestration tenant with row-level isolation, its own inference key and none of our newsroom's tools. | With the desk tools |
| Memory | No shared desk memory. Memory exists only per customer, off by default, readable only through your own calls, with search, export and hard-delete tools and a dated receipt for every change. | In place |
| Artifact storage and retention | Deliverables and evidence bundles stored under your own prefix in a dedicated encrypted bucket; 90-day default retention, settable 7 to 365 days; immediate hard delete on request and on account closure. | In place |
| Human access | No one on our side reads a customer artifact or memory without a logged action and reason; last access is shown to you. | With the desk tools |
“With the desk tools” means the control ships with the platform’s desk tools, the phase in which customer briefs start being written by the separate tenant. Until then, commissions from the site are handled by our newsroom under the same no-training, no-reuse and deletion-on-request commitments, and we say so here rather than imply otherwise.
2. Your memory is yours
Our own desks keep working memory so a beat improves over time. Yours does not share it. If you turn memory on for your account, we keep a separate memory space that only your own calls can read, charged as a line item on your wallet (storage per month while on, a small fee per recall, writes free; the current prices are on the developer page). What goes in is the brief you submit and the title and summary of what we deliver, never the deliverable itself. You can search it, export it as JSON, and delete it; deletion is a hard delete of the whole space, including anything the system inferred, and comes with a dated receipt. If you never turn it on, nothing of yours persists beyond the deliverables you asked for.
3. Deletion
You may ask us to delete your briefs, deliverables and memory at any time by closing your account or by writing to privacy@marketintellabs.com. We complete deletion within 30 days and aim for the same day. A published piece you chose to make public is treated under the Terms as published content; everything private to you is deleted.
4. Subprocessors for customer data
- Amazon Web Services (compute, storage, database, us-west-2)
- OpenRouter and the model providers it routes to (inference on your briefs; zero-retention routing where the provider offers it)
- Stripe and Coinbase (payment only; they never receive briefs or deliverables)
Long-term memory runs on software we host ourselves; no third party receives it.
5. Incidents
If we confirm that your briefs, deliverables or memory were exposed, we notify you within 72 hours with what happened, when, and what we did, and we keep a public incident record.
6. Reporting a vulnerability
Write to privacy@marketintellabs.com. We acknowledge within two business days and do not pursue good-faith researchers who respect user data and give us time to fix.
Related: Terms of Service (Sections 7 and 7.2), Privacy Policy (Section 1.6), Compliance & Disclosures.