How we look after your decisions

Where your data is kept

• In London. Decisions, answers, audit trails, attached files and accounts are stored in one database and file store in London (Supabase, on AWS eu-west-2), and the app that reads them runs in London too.
• Encrypted. Everything travels over HTTPS (TLS), and browsers are told never to use anything else. Stored data is encrypted at rest (AES-256) by our database provider.
• Only what's needed. For someone answering, that's their email address, the name they give, their answers and reasons, and when they answered. We don't use advertising or analytics trackers. The only cookies keep you signed in and remember whether you chose light or dark.
• AI only when the owner asks. AI features are optional and switched on for some teams in our beta. When a decision's owner clicks Check this decision, the draft is sent to Amazon Bedrock for suggestions. When they click Summarise the reasons, the decision points, options and the reasons people gave are sent, numbered, without anyone's name or email address. The numbers in a summary come from our database, not the AI, and the owner checks it before saving. Nothing is sent to AI unless the owner clicks one of these.
• Never sold, never used for training. We don't sell or share your data. Email addresses are used only for the decision they were invited to, never for marketing.

Who can see what

• Rules in the database itself. Who can read each piece of data is enforced by the database (row-level security), not just by the screens. A decision's answers, files and audit trail can be read only by its owner and, if the owner shares it with a team space, that space's members. Every change goes through a checked function that also writes the audit trail.
• People answering see only their own answer. They never see the invite list or anyone else's answers. They see the outcome once the owner closes the decision.
• Unguessable links. Each decision's link is a long random code. Changing a single character shows nothing. Links are kept out of search engines and aren't passed on to other sites.
• Files stay private. Attachments are kept in private storage. People answering can open them only after confirming their email address, through links that expire within minutes. The owner can see who opened each file.
• Team spaces. Members can read the decisions in their space. Only a decision's owner can change, chase or close it, and admins can't override them.

Signing in

• No passwords to steal. You sign in with a one-time code sent to your email, or with Google or Microsoft where they're switched on. Invitations can carry a personal link that signs that one person in.
• Sessions end. You're asked to sign in again every 30 days, and after a week unused. Removing people from a team space, changing their role or deleting a decided decision needs a sign-in within the last 15 minutes, and the database checks this too. Sign out of all devices is on your Account page.

A record that can't be changed quietly

• Everything is on the audit trail. Every answer, changed answer, reminder, edit, file and outcome is recorded with who did it and when. Nobody can edit or delete an entry through the app.
• Tamper-evident. Each entry is chained to the one before it with a cryptographic hash, so changing or removing an old entry, even directly in the database, breaks the chain and shows on the record.
• Fingerprinted records. Each decision record (the PDF) carries a SHA-256 fingerprint. Anyone can check a copy against the one we hold at decisionshq.com/verify.

Keeping and deleting

• A decision stays in its owner's log until they delete it. Deleting hides it at once from everyone, including its links and team space. It can be restored for 30 days, and after that its answers, files and audit trail are removed for good. Only its number, title, and who deleted it and when are kept, so a decision never vanishes without trace.
• To have your account or your answers removed, or to get a copy of what we hold about you, email privacy@decisionshq.com.

Sub-processors

These companies process personal data for us, under their own data processing terms. We'll update this list before adding anyone new.

Planned, not in use yet

Domain names are run by Cloudflare (DNS only: no decision content passes through it). If you sign in with Google or Microsoft, they confirm who you are under your own account with them.

How we build it

• Every change is tested before it goes live, including hundreds of automatic checks that other people can't read or change your data.
• A security review is run every week, and security updates to the software we use are applied promptly.
• Pages are sent with security headers that stop them being framed by other sites or sent over plain HTTP.

Questions, or found a problem?

Email security@decisionshq.com to report a security issue. Please give us a chance to fix it before telling anyone else. We aim to reply within two working days. For data protection questions, or to ask for a data processing agreement, email privacy@decisionshq.com.