Security & Compliance
Last updated: 2026-09-08
Encryption & payments
- In transit: communications between the app and our servers are encrypted with TLS.
- At rest: data is encrypted at the storage layer by our hosting and database providers.
- Account credentials: passwords are stored only as encrypted hashes.
- Payments: checkout is handled by our payment provider (hosted billing). We never receive or store your card details.
Access control
- Only core operations staff can access production systems when necessary, on a least-privilege basis.
- All access is logged, and personnel are bound by confidentiality.
- Your project data is sent only to the engines you select for a given audit. It is never used for other purposes or sold to third parties.
Retention & deletion
- Active accounts: snapshots are retained by the plan at creation time (1 month on Free, 12 months on Lite/Standard/Professional); changing plans never deletes existing snapshots, and deleting a project cascades all its snapshots.
- After account deletion: personal data is removed within 30 days.
- After Service or agreement termination: projects and snapshots are deleted within 30 days (see the Data Processing Agreement).
Training policy
SourceSight does not train any model on your data. Some AI engines (such as DeepSeek and Zhipu GLM) may use submitted content for improvement or training under their own policies; before enabling such engines, please read their data policies and acknowledge them. See the Data Processing Agreement for the full training policy.
Third-party engines & cross-border transfers
When we call third-party AI engines, their data policies are listed below. The table summarizes each engine's published data policy as of September 2026; always refer to the latest policy on each provider's official website, and we are not responsible for changes to third-party policies. Cross-border transfers use safeguards such as EU Standard Contractual Clauses; see the Privacy Policy and the Data Processing Agreement.
| Engine | Data retention | Used for training? |
|---|---|---|
| OpenAI | Deleted after 30 days by default | Not used for training |
| Perplexity | Not retained after use | Not used for training |
| Anthropic | Deleted within 30 days by default | Not used for training |
| Google Gemini | Retained for 30 days by default | Not used for training |
| DeepSeek | Stored in China | May be used for training — read the policy before enabling |
| xAI (Grok) | Deleted after 30 days by default | Not used for training |
| Kimi | Not retained long-term after use | Not used for training |
| Qwen | Per platform policy | Not used for training |
| Zhipu GLM | Per platform policy | May be used for training — read the policy before enabling |
| Doubao | Per platform policy | Not used for training |
Subprocessors
Ten engine providers, UCloud hosting (Hong Kong), a self-hosted PostgreSQL database (Hong Kong), Resend email delivery and Cloudflare DNS. The full list, notice rules and objection rules are set out in the Data Processing Agreement.
Compliance & documents
- Data Processing Agreement: available online, covering scope, subprocessors, cross-border transfers, breach notification and deletion obligations.
- For EU/EEA data transfers we rely on safeguards such as EU Standard Contractual Clauses; see the Privacy Policy.
- We do not claim certifications we have not obtained. If we obtain certifications such as SOC 2 in the future, this page will be updated.
Security incidents & reporting
After confirming a security incident involving customer data, we will notify you within 72 hours in accordance with the Data Processing Agreement. To report a security vulnerability or concern, contact support@sourcesight.app.
Page updates
We may update this page from time to time. If a material change occurs, we will notify you via in-app notification or the email address on your account, and update the date at the top of this page. Your continued use of the Service after the change takes effect constitutes acceptance of the updated content; where applicable law requires separate consent, we will obtain it as required.