FAQ

Account data. Name, email address, password hash (or the Google account used to sign in), optional avatar, two-factor enrolment, organisation membership and role.

Budget data. Budgets, versions, levels and categories, line items with planned and actual amounts per month, currencies and exchange rates, comments, owners and reminders, dashboards, and the Marketing Brain notes an organisation writes.

Integration data. Encrypted OAuth tokens for the services a customer connects, the ad spend imported from them, the invoices a customer uploads or forwards by email, and the sync logs of each connection.

Billing data. Stripe customer and subscription identifiers and plan status. Card details are held by Stripe and never reach Etropo.

Usage data. Product analytics events, error reports and session replays, as listed on the Subprocessors page.

Customer data is stored in Frankfurt, Germany: the PostgreSQL database and file storage run on Supabase in AWS region eu-central-1, and the application’s serverless functions run in Vercel’s fra1 region.

Some data is processed outside the EU by the vendors listed on the Subprocessors page, for example payments (Stripe, USA), transactional email (Resend, USA), AI model requests (Anthropic and OpenAI, USA) and product analytics (Mixpanel and Segment, USA). Each entry names the data sent and the region.

In transit. TLS on every connection, with HTTP Strict Transport Security set for two years and applied to subdomains. Connections to third-party APIs are HTTPS only.

At rest. The database, file storage and backups are encrypted by the provider with AES-256.

Application level. OAuth tokens for connected services are additionally encrypted with AES-256-GCM before they are stored, using a key that exists only in the production environment. Passwords are hashed by Supabase Auth with bcrypt; new passwords must be at least 12 characters and are rejected if they appear in known breach corpora (Have I Been Pwned).

The details are in the Cryptography and Key Management Policy.

Every table in the application schema has PostgreSQL Row Level Security enabled. Each row belongs to an organisation and the policies check the caller’s membership in that organisation on every query, so the database refuses cross-tenant reads and writes even if the application has a bug. When last checked in 2026, every table had it enabled.

Within an organisation, admins can limit a user to specific budget categories. That restriction is also evaluated in the database.

Two-factor authentication with an authenticator app (TOTP) is available to every user, with up to two devices. Once enrolled, every page, API call and database query requires the second factor; see the two-factor authentication guide.

Google sign-in is supported. SAML or OIDC single sign-on with a corporate identity provider is not available today.

AI Budget Buddy, dashboard building, the Marketing Brain and the Slack and Teams assistants run on Claude Opus 5.5 and Claude Haiku 5.5 from Anthropic, reached through the Vercel AI Gateway. Spreadsheet imports are analysed by OpenAI, and PDF invoices are read by Mistral AI OCR.

Data goes to a model provider when a user asks a question, builds something, or uploads a file, and only the data that user is allowed to see. Two scheduled jobs also run for organisations with Budget Buddy enabled: a daily one that sends budget line-item names (never amounts) to derive Marketing Brain notes, and a weekly one that sends the organisation’s Marketing Brain entries to propose open questions. All three providers are used under API terms that exclude training on customer data. Every AI call is also traced to Braintrust for quality evaluation; an organisation can ask to be excluded. A detailed “AI in Etropo” paper is available on request under Resources.

Data is kept for as long as the organisation has an account. Export is self-service: any budget can be downloaded as XLSX, or synced to Google Sheets or Notion.

To delete an account or an organisation, email team@etropo.com. Deletion is completed within 30 days, and the data then leaves encrypted backups within a further 90 days. Self-service deletion inside the product is on the roadmap.

Retention periods for logs and billing records are listed in the Data Management, Classification and Retention Policy.

Supabase takes an encrypted backup of the production database every day. The application itself is stateless and can be rolled back to any previous deployment in one click on Vercel.

Documented objectives: application recovery within 1 hour with no data loss; database recovery within 4 hours with at most 24 hours of data loss. Point-in-time recovery is not enabled. The plan and its testing status are on the Controls page.

Not yet. Since 2026 Etropo has run its security programme to the SOC 2 Trust Services Criteria, the same controls a SOC 2 Type II audit tests, and this site is its public record. No audit has taken place yet. Every control is marked in place, partial or planned so you can see exactly where we are.

The platforms the product runs on hold their own reports: Vercel (SOC 2 Type II, ISO 27001), Supabase (SOC 2 Type II) and Stripe (PCI DSS Level 1).

Yes. Send questionnaires to security@etropo.com; most answers are on this site and we will point to them. A standard Data Processing Agreement with the EU Standard Contractual Clauses is published under Resources. It takes effect when you accept the Terms of Service; if your procedures need a countersigned copy, complete its signature page and send it to security@etropo.com.

Email security@etropo.com with the steps to reproduce. We acknowledge reports within 48 hours and keep you updated until the issue is fixed. Please do not access data that is not yours, and give us time to fix an issue before disclosing it. The full terms are in the Responsible Disclosure Policy.