Built to be trusted with your brand's data
Signal360 runs on enterprise Google Cloud infrastructure in the EU, with encryption, role-based access, and transparent data handling. Here's exactly how we protect your data.
Infrastructure
Runs entirely on Google Cloud Platform in London (europe-west2). Database reachable only over a private VPC - no public IP.
Encryption
Encrypted in transit with TLS and at rest with AES-256 via Google Cloud. Database connections require SSL.
Access & authentication
Authentication via Google Cloud Identity Platform. Role-based access (owner, admin, analyst, viewer, and client roles) with client-scoped access controls.
Data residency
Application and customer data are stored in the EU (United Kingdom). We don't move your core data outside the region.
Resilience
High-availability (regional) database with automated backups retained 14 days and point-in-time recovery.
Tenant isolation
Every brand and client workspace is scoped at the query layer, with client-scoped access controls so each organization's data stays within its own workspace.
Certifications & compliance
We believe in being precise about this. Signal360 does not yet hold its own independent security certification. We run entirely on Google Cloud Platform, which maintains SOC 2 Type II, ISO 27001, and ISO 27017/27018 certifications. A formal SOC 2 attestation for Signal360 is on our roadmap.
- Underlying cloud infrastructure: SOC 2 Type II & ISO 27001 certified (Google Cloud)
- Data processing aligned with UK & EU GDPR
- EU data residency (United Kingdom)
- DPA available on request
Privacy & data protection
- Signal360 is operated by Informabiz Group and processes data in line with UK and EU GDPR.
- A Data Processing Agreement (DPA) is available on request for customers who need one.
- We practice data minimization - we collect what's needed to measure AI visibility, not more.
- Analysis prompts sent to AI model providers contain brand, competitor, and query data - not your customers' personal data.
Sub-processors
The third-party services we rely on to deliver Signal360. We keep this list current; the authoritative version forms part of our DPA.
| Provider | Purpose | Region | Used to train their models |
|---|---|---|---|
| Google Cloud Platform | Cloud hosting, database, authentication, and analytics export | EU (United Kingdom) | N/A |
| Resend | Transactional and notification email | EU / US | N/A |
| OpenAI | AI model provider - measuring brand representation in ChatGPT | US | Excluded under API terms |
| Anthropic | AI model provider - measuring brand representation in Claude | US | Excluded under API terms |
| Google (Gemini) | AI model provider - measuring brand representation in Gemini | US / EU | Excluded under API terms |
| Perplexity | AI model provider - measuring brand representation in Perplexity | US | Excluded under API terms |
| DeepSeek | AI model provider - measuring brand representation | China | Not guaranteed |
| Together AI | AI model inference for the Llama engine - measuring brand representation | US | Excluded under API terms |
| Mistral | AI model provider - measuring brand representation | EU | Excluded under API terms |
| xAI (Grok) | AI model provider - measuring brand representation | US | Not guaranteed |
“Excluded” means the provider's API or enterprise terms commit to not using your data to train their models, and we monitor those terms for changes. Where exclusion is not contractually guaranteed - currently DeepSeek and xAI (Grok) - we flag it. You can disable any engine in your workspace, so if a provider's terms don't meet your compliance bar, your data is never sent to it.
Security questions or disclosures?
Running enterprise security review, need a DPA, or reporting a vulnerability? Reach our team and we'll get back to you quickly.