Security

Your CRM export is parsed, mapped and priced in your browser. The analysis, the value model and the report are computed there. No lead, deal, name, email address, phone number, click ID, amount or free-text field from your file is uploaded to run the diagnostic, and the sample dataset sends nothing at all.

The one optional call at upload sends column headers and a description of each column's shape (its kind, fill rate and, for short category columns, its labels) so the assistant can propose a mapping. It never receives a row. A second, opt-in call sorts one free-text column you name into buckets; that text is scrubbed of addresses, phone numbers, identifiers and links in the browser and again on the server, is never stored, and is off until you switch it on.

Only what is needed to send values and to let you back in. For each workspace:

• Feed rows: a hashed email (SHA-256), the click ID where there is one, a conversion timestamp, a value, a currency and the id of the model that priced it. The database enforces this with CHECK constraints, so a row carrying a raw email, a name or an amount from your CRM is refused, not merely avoided.
• The saved model: the multipliers, the cap and the summary figures each level was fitted on. Never the deals behind them.
• Connections: HubSpot, Google Ads and Meta credentials, encrypted at rest with a key held only in the server's environment. A rotated key does not expose data; every connection simply asks to be reconnected.
• Your name and work email, given once at signup, so the workspace can be reopened from another device and so we can reach you about it. Nothing else about you.

Phone numbers, used only for matching on Meta, are hashed in the browser before they are sent and are never stored in clear.

• No passwords. A workspace is opened with Google sign-in or a one-time link that expires. There is no password to leak, reuse or reset.
• Workspace keys live in your browser and are stored server-side only as a hash, the way a password would be. A key that does not match is refused, never replaced.
• Read-only connections. The HubSpot connection asks for read scopes only. The Google Ads connection creates one conversion action and sends values to it; no campaign, budget, bid or keyword is touched. The Meta connection sends events to the Dataset you choose and nothing else.
• Operator access to the database is limited to the people who run the service, through the hosting provider's own access controls.

Every connection to the site and to the ad platforms is over TLS. Data at rest is encrypted by the database provider, and credentials are encrypted a second time by the application before they are written, so a copy of the database alone does not yield a working token.

The service runs on a short list of providers, each holding only what its role needs:

Closing a workspace deletes its feeds, rows, saved model and connections; the database is set up so that removing the workspace removes everything under it. Email alon@bettersignals.co from the address on the workspace. A Meta connection made through your Meta login can also be removed from your Meta settings, which sends us a deletion request; see Meta data deletion.

We do not hold a SOC 2 report today, and this page will say so until we do. What we can offer now is the design above: a product that keeps your CRM data out of our hands rather than one that promises to guard it once it has them. The privacy policy describes the same facts from the person's side.

If you believe you have found a security issue, email alon@bettersignals.co with what you found and how to reproduce it. You will get a reply from a person, and we will not pursue anyone who reports in good faith.