Security
Last updated October 26, 2026
Ripplewatch holds your competitors, your positioning and the reasons you win and lose deals. That is sensitive, so here is plainly what we do with it. We don't have a SOC 2 report today, and this page only states what is true now.
What a connected AI assistant can and can't do
When you connect Claude, ChatGPT or another assistant, you sign in and approve it. Once approved, it can:
- Read your competitors, momentum scores, signals and trends.
- Ask questions that are answered against your positioning and ideal customer profile.
- Add competitors, and log won and lost deals and customer feedback you tell it about.
It can't change billing or team settings. You can see every connected app and disconnect it any time in Settings, under Developer. Disconnecting revokes its access.
Who can see your data
- Each account's data is kept separate at the database level, so one customer can't see another's competitors, signals or business context.
- We don't sell your data, to anyone, for any reason.
- Your data isn't used to train AI models. Relevant parts of your business context and competitor signals are sent to Anthropic's Claude models per request to produce your scores and answers. Anthropic doesn't train on them, and our terms with Anthropic provide zero data retention, so they don't keep those requests after processing.
Encryption and payments
- Everything travels over HTTPS/TLS.
- Data is encrypted at rest in our database using our provider's standard AES-256 encryption.
- We never see or store your card number. Stripe handles all card processing on their own PCI-compliant systems.
Sign-in and keys
- Connecting an assistant uses an OAuth sign-in that you approve on a screen showing which app is asking and where it will send you back.
- Passwords are handled by our authentication provider. We don't keep them in readable form.
- If you connect with an API key instead, the key is shown to you once. We store only a SHA-256 hash of it, and you can revoke it in Settings.
Who handles your data
These are the vendors that process data to run Ripplewatch. Optional integrations, such as Slack, HubSpot, Gong and Zoom, only process your data if you connect them. See the full subprocessor list.
Swipe to see the full table →
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel | Application hosting | All data in transit to and from the app | United States |
| Supabase | Database, authentication, file storage | Account data, business context, uploaded documents | United States |
| Stripe | Payment processing | Billing details; we never see your full card number | United States |
| Anthropic | AI processing (relevance scoring, suggestions, Ask) | Business context and competitor signal text, sent per-request | United States |
| Resend | Transactional email delivery | Email address, scored-update and digest content | United States |
| Sentry | Error tracking | Technical error and request metadata, no card numbers or passwords | United States |
If your company needs a signed Data Processing Addendum, email hello@ripplewatch.aiand we'll send one.
Your data, your call
- You can ask for an export or deletion of your data at any time at hello@ripplewatch.ai.
- If you cancel, we keep your data for 30 days in case you come back, email you a week before it is deleted, and then delete it. We delete it sooner if you ask.
- Our Privacy Policy has the full detail.
Found a problem?
Email security@ripplewatch.aiwith what you found and we'll look at it promptly and tell you what we did.