Trust Center
You trust us with your customer data and the records behind them. Here is how we protect them.
Last updated November 2, 2026
Our commitments
Your files come to us.
You upload into a code-named folder in our secure file room. Never by email.
Read only by the people and tools doing your work.
Access is limited to Buyable staff on your engagement and named processors, each seeing only what its work needs.
Never used to train AI.
We use AI models only under terms that bar training on your data.
No controlling access to your systems.
We never ask for admin rights, network access, or anyone's login.
Deleted when the work is done.
Rapid Scan files are deleted within 30 days after the Scan Result, with written confirmation.
We notify you within 48 hours
of becoming aware of a suspected or confirmed incident.
Security program status
- In place
Two-step login on all Buyable accounts
- In place
Email authentication (SPF, DKIM, DMARC)
- In place
Written incident response plan
- In place
Cyber and professional liability insurance, $1M each
- In place
Data Processing Agreement
Available on request
- In place
Written information security policies
- In progress
Cloud Security Alliance self-assessment (CAIQ)
- In progress
SOC 2 Type 1 report
Data processors
We use a small number of outside companies, each bound by written terms at least as protective as ours. The named list is in Schedule 3 of our Data Processing Agreement and is available on request.
- Secure file storage: an enterprise file platform that holds raw files and carries its own independent security audits.
- Application hosting and database: runs the Buyable app, which holds findings only.
- AI model providers: leading AI models used under business terms that bar training.
- Specialist data processors: specialists who receive only what a job needs, under code names.
- Workplace productivity: email, documents and calendar for our team.
Documents available on request
- Security Overview
- Data Processing Agreement, with processor list
- Information Security Policies (under NDA)
- CAIQ self-assessment (under NDA)
- Certificates of insurance
- Processor security reports (under NDA)
Need more for your security review?
We will send our security packet, complete your questionnaire, or get on a call.
Request our security packetOr email security@getbuyable.com
Report a security concern
If you believe you have found a vulnerability or security issue, email security@getbuyable.com with the subject 'Security report'. We will respond promptly.