Security & Privacy

Better Analyst is committed to protecting your data with industry-leading security practices. We work with enterprise customers and can collaborate with your security team to meet specific requirements.

Our Security Commitment

We adhere to industry-leading practices to ensure data security:

• Encryption in Transit: All data is transmitted over TLS (HTTPS)
• Encryption at Rest: Data is encrypted using AES-256 encryption
• Secure Infrastructure: Hosted on AWS, which meets 143 security standards and certifications
• Security Headers: HSTS, XSS protection, and MIME type sniffing prevention enabled on all requests, plus a Content Security Policy in report-only mode that reports unexpected scripts without blocking anything yet

Privacy Commitment

We are committed to user privacy with the following principles:

• No Data Selling: We never sell your data to third parties
• Data Minimization: We only collect data necessary for the service to function
• User Control: You can access, export, and delete your data at any time
• Transparency: We clearly disclose what data we collect and how it's used

Compliance

Better Analyst strives to comply with all applicable regulations:

• GDPR: We comply with the General Data Protection Regulation for EU users
• U.S. Regulations: We comply with applicable U.S. laws for technology providers
• SOC 2 Type II: Our infrastructure provider (AWS) maintains SOC 2 Type II certification

Data Storage & Protection

Where Is My Data Stored?

All data is stored in Amazon Web Services (AWS) data centers:

• 143 security certifications including SOC 2, ISO 27001, and PCI DSS
• TLS encryption for all data in transit
• AES-256 encryption for all data at rest
• US region (us-east-2) for databases and file storage

Data Isolation

Your data is isolated from other users through multiple layers:

• Row-Level Security (RLS): Database policies limit every request to your own workspace and the teams you belong to, and inside a team to the projects and chats you're allowed to see
• Folder Isolation: Each user has a dedicated folder in our storage system
• Encrypted Credentials: Database passwords, warehouse keys and OAuth tokens are encrypted by a dedicated AWS encryption service before storage

Rate Limiting & Protection

We implement multiple layers of protection against abuse:

• Sign-in Rate Limiting: Repeated sign-in attempts are throttled by our authentication provider
• Password Reset Limiting: Two reset emails per address per hour, then a one-hour block, plus a per-network limit
• Verification Code Limiting: Five codes per 15 minutes, each valid for 15 minutes with five attempts
• API Rate Limiting: Limits on authentication and other sensitive endpoints
• Add-in Sign-in: The spreadsheet add-ins accept a Google sign-in only when the token was issued to Better Analyst, and password sign-ins in the add-ins are limited per network address and per account

Account Security Features

Multi-Factor Authentication (MFA)

Better Analyst supports TOTP-based two-factor authentication. Team owners on the Enterprise plan can also require it, or require single sign-on (SSO), for their whole team:

• Use any authenticator app (Google Authenticator, Authy, 1Password, etc.)
• Recovery codes provided for backup access
• MFA can be enabled in your account settings
• Teams on the Enterprise plan can require it for every member

Team Sign-In, Audit Log, and Data Access

Teams on the Enterprise plan also get:

• Single sign-on (SAML) with Okta, Microsoft Entra ID, Google Workspace, or any SAML 2.0 identity provider, after verifying your email domain with a DNS record
• SCIM provisioning, so your identity provider adds and removes members
• Sign-in requirements: the team owner can require SSO or two-factor authentication. The requirements apply in the web app, the Excel add-in, and the ChatGPT plugin, and the database enforces them too
• A team audit log of sign-ins, member, data access, sharing, and identity changes, including data access edits by a source's access managers, which admins can filter and export (teams on the Team plan can view the last 30 days)
• Per-member data access: member attributes such as region or department decide which rows, tables, and columns each person sees on a shared data source, in chat and on dashboards. Chats that use that data are private to the person who ran them
• Data access managers, who look after one data source's access rules without being admins
• Per-viewer dashboards, where each viewer sees only their own rows, and View as a member, so owners and admins can open a dashboard or ask a test question as a teammate
• Private projects, limited to chosen members, with project-only data sources (Private projects)
• Viewers, who open the team's dashboards and nothing else, for free (Roles & Permissions)

See SSO and SCIM, Team audit log, Member attributes, and Set up per-member data access.

Email Verification

New accounts require email verification with:

• 6-digit verification codes
• 15-minute code expiration
• 5-attempt limit to prevent brute-force attacks

Secure Password Reset

Password reset requests include:

• Time-limited reset links
• Rate limiting to prevent abuse
• Email notification of password changes

OAuth Security

Google integrations (Analytics, Search Console, Google Ads, Sheets) use:

• Industry-standard OAuth 2.0 protocol
• Minimal permission scopes (only what's needed). Google offers a single Google Ads API scope; Better Analyst uses it read-only and never changes campaigns, budgets, or ads
• Tokens encrypted by a dedicated AWS encryption service before storage, with automatic refresh. This includes Google Analytics, Search Console, and Google Ads
• Tokens are never exposed to the browser

The Meta Ads integration (coming soon) uses Facebook Login for Business with:

• Read-only reporting access (ads_read) plus business_management to list the ad accounts in the businesses you choose to share. Better Analyst never creates, edits, or pauses campaigns
• Long-lived Meta tokens (about 60 days) encrypted by the same AWS encryption service before storage, and renewed while you use the connector
• Tokens are never exposed to the browser

Data Retention

How Long Is Data Stored?

Retention depends on your plan:

	Free Plan	Paid Plans (Pro, Team, Enterprise)
Chats & Messages	Deleted after 60 days of inactivity	Retained indefinitely
Uploaded Files	Deleted after 60 days	Retained indefinitely
Account Data	Until you delete your account	Until you delete your account
Connection Credentials	Until you remove the connection	Until you remove the connection

What Happens When I Delete My Account?

Deleting your account permanently removes all associated data:

• Chat history and messages
• Uploaded files
• Database connections
• Tasks and automations
• OAuth connections
• All user settings

Your Data Rights

You have full control over your data:

• Access: View all your data within the Better Analyst interface
• Export: Download your chat history and data
• Delete: Remove individual files, chats, or your entire account
• Portability: Export your data in standard formats

To exercise these rights or make a data request, contact hello@betteranalyst.com.

Third-Party Services

The companies that process customer data on our behalf, and what each one handles, are listed on our subprocessors page.

Data sources you connect, such as Google Analytics, Slack or Snowflake, are accessed with your authorization under your own agreement with them.

All third-party connections use HTTPS/TLS, and authorized connections use OAuth 2.0.

AI Model Training

Our AI usage policy:

• Data is only used to process your specific requests
• Requests are sent with response storage at OpenAI turned off
• Analysis code runs in an isolated sandbox for each chat
• You can delete your conversation history at any time

Security Best Practices for Users

To keep your account secure:

1. Enable MFA: Add an extra layer of protection to your account
2. Use Strong Passwords: Use a unique, complex password for Better Analyst
3. Review Connected Accounts: Periodically review your OAuth connections
4. Monitor Activity: Check your chat history for any unauthorized access
5. Keep Credentials Private: Never share your login credentials

Contact Us

For security questions or to report a vulnerability:

• General Inquiries: hello@betteranalyst.com
• Security Issues: hello@betteranalyst.com (include "SECURITY" in subject)

For more details, see our security page, data processing agreement, full Privacy Policy, and Terms of Service.