Security

Martech Stack Builder holds stack diagrams, vendor evaluations, procurement records and, on Enterprise, vendor contracts. This page covers how we protect them. More detail, including answers to security questionnaires, is available under NDA: security@martechstackbuilder.com.

Your data

• Stored in the EU: your account, diagrams and uploaded files are stored in the EU (Stockholm). Some suppliers process data outside the EU; they are listed under Sub-processors.
• Encrypted: at rest with AES-256, and in transit over HTTPS.
• Backed up: the database is backed up every day, and each backup is kept for 7 days.
• Kept apart: the database itself decides which workspace's data each signed-in user can read or change, so one workspace cannot reach another's.

Sign-in and access

• No passwords: you sign in with Google, or with a link or code we email you. We store no passwords.
• Two-factor authentication: anyone can turn on an authenticator app in Settings. On Enterprise, owners and admins can require it for the whole workspace.
• Five roles: Owner, Admin, Editor, Viewer and Approver. Viewers and approvers have read-only access. Removing someone, or changing their role, takes effect on their next request.
• Share links: a link to a diagram can carry a password and an expiry date, and you can revoke it.

Audit log

• What it records: owners and admins of Team and Enterprise workspaces see member and role changes, sharing, and every contract event: uploaded, changed, deleted, read by AI, downloaded, used in an answer, read through a connected AI assistant, and decrypted.
• Retention: 30 days on Team and 365 days on Enterprise. Contract events are kept 365 days on every plan.
• Export: CSV export on Enterprise.
• Tamper-resistant: no one can edit or delete an event through the app or the API, and each event keeps the person's name after their account is gone.

Contracts and documents

Enterprise workspaces can upload vendor contracts, SLAs, DPAs and order forms.

• Private storage: contract files are never public. A download checks your access, is recorded in the audit log, and uses a link that expires after a minute.
• A key per workspace: the contract text, extracted terms, clauses, search passages and any chat that quotes them are encrypted with your workspace's own key. One workspace's key cannot read another's data. The uploaded file itself has the standard encryption at rest, and dates, amounts and categories stay unencrypted so you can sort and filter them.
• Who can decrypt: members of your workspace, through the app. Our operator can too; every decryption is recorded in your workspace's audit log.

AI processing

Contract text goes to an AI provider only after a workspace owner or admin has accepted AI processing for the workspace, and we check that consent on every request. You review extracted terms before they are used in your stack. What each AI feature sends:

OpenAI does not use data sent through its API to train its models. It keeps API inputs and outputs in its abuse-monitoring logs for up to 30 days, unless the law requires it to keep them longer, and then deletes them. On every request we send to OpenAI we also switch off its optional storage of responses. We have applied to OpenAI for Zero Data Retention, which removes the abuse-monitoring copy; until OpenAI confirms it, the 30-day retention applies. OpenAI's data controls.

Deletion

Deleting a document removes its file, its encrypted text, its extracted terms, its search passages and any chat that quotes it. Deleting a workspace removes all of its documents and destroys its encryption key. Chat transcripts are deleted after 90 days. Deleted data, including a deleted workspace's key, can remain in the daily backups for up to 7 days, and then it is gone.

Sub-processors

Suppliers that process customer data for us. Certifications are the supplier's own, as published on their trust pages; they are not ours.

Martech Stack Builder itself holds no ISO 27001 or SOC 2 certification. The full supplier list with data processing agreements is available on request.

Reporting a vulnerability

Report security issues to security@martechstackbuilder.com. Our disclosure policy commits us to:

• acknowledging a report within 48 hours,
• triaging it within 7 days,
• taking no legal action against good-faith research.

Questions

For security questionnaires, procurement reviews and the detail behind this page, under NDA, write to security@martechstackbuilder.com.