Trust, privacy & security

Where is my data processed?

The application and its database run on managed cloud infrastructure that we operate.

Some work is done by third parties in their own systems rather than ours: AI answer engines, search and data providers, embeddings, generative AI, payment processing, email delivery and site analytics. They may process data in more than one country, as the Privacy Policy explains.

What do you keep?

We keep the questions you track, the answers and citations the engines return, and your account details. If you connect an account we also keep its tokens and the metrics it provides, and if you upload knowledge-base content we keep it with its search index. Audit log entries carry a source address and browser detail.

Our Privacy Policy states that we do not sell personal data.

How long do you keep it, and how is it deleted?

Scan history, with its answers and citations, is kept for your plan’s retention window. Raw answer text from Google AI Overviews and AI Mode is deleted after 90 days, or sooner if your plan’s window is shorter. The measurement outcome from those two surfaces, without the raw text, stays until the brand or organization is deleted. If a trial ends without converting, we keep its scan history for 180 days. The source address and browser detail on audit log entries are cleared after 90 days, and stored YouTube data is purged within 30 days of a disconnect or a lost authorization.

Deleting an account’s data is carried out by our team, not by a self-service button. To ask for it, write to privacy@ansyra.com.

Who are your sub-processors?

By function: cloud hosting and database, payment processing, AI answer engines, search and data providers, embeddings, generative AI, email delivery, support chat and analytics. The Privacy Policy lists each function with its purpose and a location category. To ask about the current list, write to privacy@ansyra.com.

What can a connected account see?

Connections are optional. Google Search Console and Google Analytics 4 are read-only. YouTube is read-only and measures only your own channel, with no revenue or write access. Search Console and Analytics also ask for basic sign-in identity, so we can tell which Google account was linked.

Google Ads is used for keyword volume: Ansyra lists the accounts you can access and reads keyword volume estimates.

Connected-account tokens are stored encrypted. Disconnecting deletes the stored credential, and you can also remove Ansyra from your Google account permissions.

How is access controlled?

Access is role-based across nine roles. You can sign in with email and password, or with Google or Microsoft. Passwords are stored only as a secure hash. Two-step verification is available, with emailed one-time codes as the default second factor.

Each organization’s data is separated at the database level with row-level security, and the application connects as a role that cannot bypass it. Maintenance and staff tools, such as retention and deletion jobs, use a separate owner connection that is not subject to those policies.

Is there an audit log?

Changes such as connecting or disconnecting an account are recorded in an audit log. The application’s database role cannot update or delete audit entries, and each entry is signed into a hash chain.

What technical protections are in place?

Secrets such as connected-account tokens and stored credentials are encrypted before they are stored. Our site and API are served over HTTPS. Sign-in and recovery requests are checked for cross-site forgery, and pages are served with headers that block framing and content-type sniffing.

An automated check for known vulnerabilities in production dependencies runs in our continuous integration. This page describes only controls we run ourselves. It does not claim a third-party assessment or certification.

Screening, not sign-off

An international regulator rule library screens generated content for review before it ships. You choose the regulator that applies to each brand, and screening starts when you do. Until a regulator is chosen, no regulator pack screens the brand, though any rules you write yourself still do. Once one is chosen, content is screened against that regulator’s rules, the global pack, and other regulator packs for the brand’s markets that cover its industry or every industry. Screening is advisory: it flags for a human, and legal review always stays with you.

How do I report a security concern or ask for a DPA?

To report a security concern, write to security@ansyra.com. For privacy requests, or to ask for a Data Processing Addendum, write to privacy@ansyra.com. The Terms of Service say a Data Processing Addendum is available for business customers who need one.

Straightforward subscription

Ansyra is a subscription service. Plans, limits, and billing are described on the pricing page. Read the full Terms of Service.