Bayesin Trust Center

At a glance

• Your data only. Models are fit on your data. No cross-customer pooling, and your data is never used to train models for other customers.
• Never sold. No sale of data, no sharing with advertisers or data brokers.
• Minimal by design. Spend, conversions, and revenue by channel and date.

Data we use

What data does Bayesin need?

Bayesin fits models on marketing and revenue performance data: spend, impressions, clicks, conversions, and revenue by channel and date. Models do not require names, emails, or other direct personal identifiers. The exact fields each integration pulls are listed in our data field map.

Do you collect personal data?

Bayesin does not require personal data to fit a model. If you choose to send identifiers, such as CRM contact IDs for attribution, we process them only on your behalf. You can aggregate or hash identifiers before upload.

How do you connect to my tools?

Through integrations with ad platforms, CRM, warehouse, and commerce tools, or by weekly CSV upload. Read-only access wherever the platform supports it. You can disconnect any integration from your account at any time.

Privacy and compliance

Is Bayesin GDPR compliant?

We support your GDPR obligations. We act as your processor and you remain the controller. We offer a Data Processing Agreement covering Article 28 terms, publish a subprocessor list, and honor access, export, and deletion requests.

How do you handle CCPA and CPRA?

We act as a service provider under CCPA. We use your data only to deliver the service to you. We do not sell your data and do not share it for cross-context behavioral advertising.

Where is my data stored?

Amazon Web Services (AWS), in the United States.

Do you have SOC 2 or other certifications?

Not yet held, with our security overview and questionnaire responses available on request.

How long do you keep my data, and can I delete it?

You can export your data and request deletion at any time. After cancellation, we delete your data within 7 days, including backups within 7 days.

Third-party sharing

Do you sell or share my data?

No. We do not sell customer data and do not share it with advertisers or data brokers.

Will my data train models for other customers?

No. Each customer's model is fit on that customer's own data. Your data is not pooled to train or improve models used by other customers.

Who are your subprocessors?

We use a small number of infrastructure vendors to run the service, such as our cloud host. The current list is below, with each vendor's purpose. We notify customers of changes by email with 30 days' notice.

Current subprocessors:

• Amazon Web Services: infrastructure, data storage, and compute for model fitting.
• Supabase: account sign-in and the application database.
• Vercel: application and website hosting.
• Stripe: payment processing and billing.
• Sentry: error and performance monitoring.
• PostHog: product analytics.
• Anthropic (Claude): plain-language explanations of your results, only if your organization turns AI explanations on (they are off by default). Anthropic receives aggregate figures, such as a chart's table rows and totals, and never identifiers, subject-level rows, raw events, or credentials.
• Resend: transactional email.

Which of our team members can see our data?

Access is limited to staff who need it for support or operations, requires role-based permission, and is logged.

Security

How is my data encrypted?

In transit: TLS 1.2 or higher. At rest: AES-256.

How are credentials for my connected tools stored?

Encrypted in a managed secrets store, never displayed in plaintext, and never used outside the integration you authorized.

Do you support SSO and multi-factor authentication?

MFA is available now. SSO is planned for January 1, 2027.

What happens if there is a security incident?

We notify affected customers without undue delay, and within 72 hours of confirming an incident that affects their data, with details on scope and the steps we are taking.

Do you run security testing?

Penetration testing, vulnerability scanning, and dependency monitoring.

Hosting options

Can I host Bayesin on my own servers?

Bayesin is currently a cloud service. If you need to limit what leaves your environment, connect through a scoped, read-only warehouse view or send weekly CSVs of aggregated data, so sensitive fields stay with you.

Can I limit what Bayesin can see?

Yes. You choose which integrations to connect and which tables or fields to expose. We recommend starting with aggregated channel-level data.

Getting help

Who do I contact with a security or privacy question?

Email security@bayesin.com. We respond within 2 business days. Security researchers can report vulnerabilities to the same address.

Can I get a security questionnaire completed?

Yes. Send it to our security contact and we will respond within 7 days. A pre-filled overview is available on request.

Last updated: October 11, 2026 | bayesin.com