Compliance & Security
How AI Insights 365 protects your data. GDPR, encryption-in-transit and at-rest, role-based access control, full audit logging, and an on-premises gateway that keeps private data inside your firewall. One page, no legalese.
GDPR
AI Insights 365 acts as a data processor on behalf of our customers (the data controllers). We process only the data necessary to deliver the service, never sell customer data, and never use it to train third-party models.
Your rights as a data subject
- Access — export every record we hold about your account at any time from Settings → Account → Export my data.
- Rectification — edit your profile from the same panel; changes are immediate.
- Erasure ("right to be forgotten") — close your account from Settings → Account → Delete. Personal data is purged within 30 days; backups roll off within 90.
- Portability — every workspace, dashboard, and report exports as JSON / CSV.
- Restriction & objection — disable AI agent processing from Settings → AI & Privacy; the platform continues to work without it.
To exercise any right outside the self-serve flow, email support@aiinsights365.net. We respond within 30 days.
Security controls
| Control | Implementation |
|---|---|
| Encryption in transit | TLS 1.2+ on every public endpoint. HSTS preload. Modern cipher suites only. |
| Encryption at rest | AES-256 for the application database and gateway-issued tokens. Datasource connection strings and API keys are encrypted before persistence. |
| Authentication | Email + password. Passwords are stored as PBKDF2-HMAC-SHA256 hashes (100,000 iterations, per-user 128-bit salt), never in a recoverable form. Signed, expiring access tokens. Per-user lockout after 5 failed attempts. Optional MFA on the Premium plan. |
| Access control | Role-based: Viewer / Editor / Admin / OrgAdmin. Every API endpoint is gated by a per-workspace permission check. |
| Audit logging | Every login, role change, datasource modification, and admin action is written to an immutable activity log retained for 12 months. |
| Org isolation | Multi-tenant SaaS with row-level segregation. Cross-organization data access is impossible by design — every query carries an OrganizationId scope. |
| Vulnerability management | Dependencies scanned on every build. Critical CVEs patched within 7 days; high within 30 days. Quarterly external pentest planned. |
| Backup & DR | Daily encrypted DB backups, retained 30 days. Point-in-time restore. Cross-region replication for Premium customers. |
Data residency & the on-prem Gateway
Sensitive data never has to leave your network. The AI Insights Gateway is a small Windows agent you install inside your own firewall.
- The gateway holds your local database credentials. Credentials never cross the WAN.
- Only outbound HTTPS traffic is used — no inbound firewall rules required.
- The gateway authenticates against the cloud with a per-org token that is fully revocable.
- Every query the cloud sends is logged locally on the gateway machine for your own audit.
The cloud control plane itself runs in the EU (primary) with a US fail-over region for resiliency. Premium customers can pin processing to a single region.
Subprocessors
We use a small set of trusted infrastructure providers. Each is bound by a DPA that mirrors our own commitments to you.
| Provider | Purpose | Region |
|---|---|---|
| SmartASP.NET | Web application hosting + SQL Server | EU |
| Azure AI (Microsoft) | LLM inference for the AI agent (no training on customer data) | EU (Sweden) |
| PayPal | Subscription billing and invoicing | Global |
| SmarterMail / site4now mail | Transactional & subscription emails | EU |
| Cloudflare | DNS, DDoS mitigation, CDN for static assets | Global edge |
We notify customers by email at least 30 days before adding or replacing any subprocessor that handles personal data.
Incident response
If we detect or are notified of a security incident affecting customer data:
- 0–4 h — incident triage, scope identification, containment.
- Within 24 h — affected customers notified by email with what we know.
- Within 72 h — written notification to the relevant supervisory authority where GDPR Article 33 applies.
- Within 14 days — full post-mortem published to affected customers, including root cause, scope, and corrective actions.
Report a security concern responsibly at support@aiinsights365.net. We acknowledge within one business day.
Certifications & roadmap
- GDPR — compliant today. DPA available on request.
- ISO/IEC 27001 — controls already aligned. Formal certification on the FY26 roadmap.
- SOC 2 Type II — audit window starts Q3 2026; report expected Q4 2026.
- HIPAA — available on the Premium plan with a BAA. Roadmap.
- Cyber Essentials Plus (UK) — under evaluation.
Need an unreleased report or questionnaire response? support@aiinsights365.net.
Have a security or compliance question?
Send us a note — most replies arrive same business day.