Security and data
Where your data lives, and how it is handled.
Strategy work is confidential. Here is what happens to what you put in, explained in plain language: where it lives, who can see it, and what the AI processes.
Where data lives
Data we store stays in the EU
The application runs in Frankfurt (Render) and the database lives in Ireland (Supabase). Data stored by the tools remains in the EU. When AI processes a case, the necessary text is sent to Anthropic outside the EU; that is described below, and your database, journal and files remain in the EU.
Your data is yours
Charters, strategy projects, decisions and journals are tied to your account and separated from everyone else's with row-level security in the database itself, not just in the application.
Download or delete it yourself
On the page Your account and data you download everything you have put into the tools as one file, or delete the account and all content immediately. You do not have to ask anyone first. Purchase records are kept without your name because Danish bookkeeping law requires it.
Payments with Stripe
We never see card details; they are handled by Stripe, certified for exactly that (PCI DSS). We keep only the payment reference, so your receipt can be found again.
How it is handled
Encrypted all the way
All traffic between your browser and our servers is encrypted (TLS), and the database encrypts data at rest.
Access limited to what is necessary
Only what is needed to deliver the tool is retrieved. Nothing is sold on, and nothing is shared with third parties beyond the processors that run the platform.
Web statistics without surveillance
We count visits in our own database in Ireland: we use no cookies, create no visitor profiles and do not share or sell the data.
Backups in two layers
Supabase takes a daily backup of the database with seven days of history, and on top of that we take our own copy of every table, kept outside the platform.
Voice input stays in your browser
If you speak to the coach or the board, your browser itself turns speech into text. In Chrome and Edge that happens at the browser vendor (Google or Microsoft); audio never passes through our servers, and the button is optional.
Data processing agreement
When a company buys access, we send a data processing agreement based on the Danish Data Protection Agency's template the same day it is requested. Write to cdla@upscalestrategy.com.
Sub-processors
Render, Frankfurt
Runs the application. Traffic passes through Render's network (Cloudflare), which terminates TLS and protects against overload; no content is stored there.
Supabase, Ireland
Database and login. Everything you save in the tools lives here, separated per account with access control in the database itself.
Stripe, Ireland
Payment, receipt and invoice. Card details are handled by Stripe only; we keep the payment reference.
Anthropic, USA
The AI model behind the coach and the board. It receives only the text of the current call, does not train on it and by default keeps it for no more than 30 days to detect misuse. Amazon Bedrock in Frankfurt is prepared as the EU alternative.
Brevo, France
The Indspil newsletter, system emails and enquiries from the contact form, which reach us as email. For the newsletter only email address and name; for an enquiry also the text you write.
Microsoft 365, EU
Our own email when you write to us.
GitHub, USA
The code. No customer data lives in the code.
What you share with the tools
Strategy work is confidential. Here is what the two tools store and process.
Strategy Lab and Decision Room are where you write things you would not post on LinkedIn: figures that are not public, a decision not yet made, and a judgement about people and markets. So here is what the two store, and what they do not.
Decision Room
What you give it
- Your charter: role, company, strategy, situation, stakeholders and decision principles
- The decision itself, your current view, and what you tell the advisers along the way
- Your own decision at the end, with rationale, first step and owner
How it is stored
All of it sits in your account in the database in Ireland, separated from everyone else's by row-level security in the database itself. It stays, because the journal is the whole point: you must be able to look up what you decided, and why.
The advisers are AI personas. They do not retain memory between sessions; the journal stores the record.
Strategy Lab
What you give it
- Your company registration number and website, used to pull public financials and industry figures
- Your starting point, the owners' intent, your benchmark and your critical SWOT
- Ambition, targets, Must Win Battles with owners and numbers, and the one-page strategy
- Your own images for the presentation, if you choose to add them; they live in a private folder on your account in Ireland
How it is stored
The project sits in your account with the same separation. Basic company facts are fetched from cvrapi.dk directly from your browser, so cvrapi.dk sees your IP address as with any other website visit, and only the CVR number is sent. Financial statements are fetched from the Danish Business Authority's open distribution service (which only offers unencrypted http; only the CVR number is sent) and industry figures from Statistics Denmark. All three are already public; it is your own judgements and choices that are confidential.
The presentation and the one-page strategy are generated by us. They are not sent anywhere.
Deleting your data
You do it yourself on the page Your account and data: download everything you have put in as one file, then delete the account with charter, projects, decisions and journal. It happens immediately and cannot be undone. We keep only what accounting law requires about the purchase itself, meaning the invoice without your name, not the content. If you would rather have us do it, write to us and we will within five working days.
And what does the AI see?
The AI gets the case, not your life.
When the board works or the coach challenges, the necessary parts of your case are sent to our AI provider through one controlled channel. Concretely:
- The AI gets what you have entered in the current tool, plus the public sources you have approved: register data, annual reports and your website.
- The model provider is Anthropic, and the call is currently processed outside the EU, including in the United States. It is the one thing that leaves the EU, and it is only the text in the call, never your database, your journal or your files.
- Anthropic states that data sent through their API is not used to train the models. By default, Anthropic retains what is sent to and from their API for up to 30 days to detect misuse, and then deletes it. We do not use your cases for any purpose other than delivering the response you requested.
- The solution is technically prepared for model processing to be moved into the EU, to Amazon Bedrock in Frankfurt, without changing the products. If you require that nothing may leave the EU, tell us before you enter anything confidential.
- AI output is clearly labelled as advice and challenge, not as a final decision. The decision stays with you, and it says so on every page.
You can always request access to, correction of or deletion of your data. Write to us and it happens without delay.
The details, including processors and your rights under GDPR, are in the privacy policy.
Questions about security? Write to cdla@upscalestrategy.com and a human will answer.