Security & data

Your idea is the asset. We treat it that way.

What we collect, where it lives, who can see it, and the one question everyone asks: no, your data is never used to train AI models.

  • Encrypted at rest and in transit
  • EU data residency available
  • Never used for model training

Confidential by default

Ideas submitted on this website and inside the app are treated as confidential information. They are encrypted at rest with AES-256 and in transit with TLS 1.3, and they are visible only to you, the people you invite, and the small number of staff who need access to support you.

Never used for training

Your idea, artifacts, prospect data and replies are never used to train AI models — ours or a provider's. We use zero-retention model endpoints, so prompts and completions are not stored by the provider. This is a contractual commitment, not a setting you have to find.

You can take it all with you

Every artifact, sequence, page and prospect record exports in an open format at any time, including after you cancel. Deletion requests remove your data from production within 30 days and from backups within 90.

AI accuracy

How "ultra-accurate" is earned.

A claim about accuracy is worthless without a method. This is ours, and every artifact shows you enough to audit it yourself.

  1. Multi-source research, not one model's memory

    Every finding is researched against independent current sources — filings, regulator guidance, market research, pricing pages, and interview transcripts where you have them. A model's unsourced recollection never becomes a finding.

  2. Cross-validation before writing

    Claims that matter — market size, pricing benchmarks, regulatory duties — are checked against at least two independent sources. Where sources disagree, the artifact says so and shows both.

  3. Citations on the face of the artifact

    Sources are listed on every artifact, not buried. If you cannot trace a finding to something you could read yourself, treat it as a bug and tell us.

  4. A confidence score that means something

    Confidence reflects source quality, source agreement and recency. Low confidence is shown, not hidden, and low-confidence findings are flagged as assumptions to test rather than facts to plan on.

  5. Human review where it counts

    On Growth and Scale, you can route any artifact for human review before it drives outreach or pricing. Regulated categories default to review on.

What we will not claim. PumaDoc's research is as good as its sources and it can still be wrong. It does not replace legal, regulatory, tax or medical advice, and findings in regulated categories should be confirmed with a professional before you act on them.

Outreach safeguards

Sending on your behalf, within the rules.

Before anything sends

  • Sending domains are warmed on a ramp; volume is capped per domain and per mailbox.
  • Suppression lists — your customers, competitors, anyone who opted out — are enforced at send time, not after.
  • Sender identity and a physical address are present in every message.
  • Review mode holds every first send from a new domain, regardless of plan.

Legal basis and opt-out

  • One-click unsubscribe in every message, honoured immediately and permanently across all your ventures.
  • B2B sending is configured for the rules of the recipient's country — CAN-SPAM, GDPR and ePrivacy, CASL.
  • You remain the sender and the controller of your prospect data. PumaDoc acts on your instruction.
  • A single kill switch stops all sending immediately.

Sub-processors

Who else touches your data.

Sub-processors, their purpose, data location and safeguards
CategoryPurposeLocationSafeguard
AI models — Claude (Anthropic), Codex (OpenAI)Artifact research and writing; landing-page code changesEU / USZero-retention endpoints; no training on customer data
Cloud hostingApplication and databaseEU (Frankfurt), US optionalEncrypted at rest and in transit
Your connected toolsVercel, Supabase, Stripe, Apollo.io, Instantly, Amplitude, your CRM, LinearPer your own accountsYour contracts, your keys — PumaDoc acts on your instruction only
CRMLead records from this websiteEUStandard contractual clauses in place
Email deliveryTransactional and marketing emailEU / USStandard contractual clauses in place
AnalyticsWebsite behaviour, consent-gatedEU / USLoaded only after analytics consent

⚠️ The remaining categories must be resolved to named providers before launch. A current, named list and a Data Processing Agreement are available on request from privacy@pumadoc.com. We give notice before adding a sub-processor.

Compliance

Where we are, honestly.

We would rather tell you what is in progress than imply a certification we do not hold.

Now
GDPR compliant. EU data residency available on Scale. DPA on request. Encryption at rest and in transit.
In progress
SOC 2 Type II — observation period under way. We will publish the report date when it is confirmed, and not before.
Reporting
Security issues to security@pumadoc.com. We acknowledge within one working day and do not pursue good-faith researchers.

Start now

Read the method. Then try it on your own idea.

Sign up, describe it in a sentence, and PumaDoc takes it from there.