Security and data handling
What happens to your data. Step by step, without badges.
DataTruth works from exports only. We never log in to your systems and nothing is installed. You send exports under an NDA and a data processing agreement. We keep quality metrics and the memo, and delete your exports after the engagement. This page sets out each step, including where we use a language model, so your finance, IT or legal lead can check it before anything moves.
Starts with a 30-minute call. Commits you to nothing.
Before anything moves
NDA and data processing agreement signedYour team
Runs standard exports from our field listWe analyse
Records matched across systems, red flags checked by handWe keep
Quality metrics and the memoWe delete
Your exports, after the engagement
The facts
Four rules. Every engagement.
Exports only
No logins to your systems and nothing installed. One person on your team runs standard exports from a field list we send first.
NDA and data processing agreement first
Both are signed before any data moves. Your templates or ours.
Sub-processors disclosed
The full list of sub-processors comes with our data processing agreement, before any data moves. Any transfer outside the EU is covered by Standard Contractual Clauses or another safeguard GDPR approves.
Exports deleted after the engagement
We keep quality metrics and the memo. The memo cites a handful of sample records as evidence.
Step by step
Eight questions your reviewer will ask. Answered in order.
From the field list to the deletion, in the order it happens. If your security questionnaire asks something this doesn’t cover, we answer it in writing before you send anything.
-
01What we receive
Exports, and the plan or proposal if there is one.
Exports are spreadsheets downloaded from each system: CRM, billing, finance, HR, projects, support. We send the field list first, so you send only the fields the decision needs. No logins, no software installed, no connection left open.
-
02Before anything moves
An NDA and a data processing agreement, signed.
Your templates or ours. The data processing agreement says what we may do with the data, who processes it, and when it is deleted.
-
03How it reaches us
By a transfer method your IT team agrees to.
Agreed on the kickoff call, before the first file is sent. You decide what leaves your systems; nothing is pulled from them.
-
04Who can see it
Only the DataTruth people working on your engagement.
Nobody outside DataTruth sees your exports, apart from the providers that run our tools, and every one of them is on the sub-processor list that comes with our data processing agreement.
-
05How it is analysed
Our engine matches records across your exports.
It matches the customers, people, deals and invoices across the exports you send, and measures each of the six pillars. Every red flag is checked by hand against sample records before sign-off.
-
06Where AI is used
To read your plan and help word the memo. Never to score.
The score and the findings come from rules, not a model. See the full answer below, including how to switch it off for your engagement.
The full answer -
07What we keep
Quality metrics and the memo.
Figures such as how many customers matched between two systems, fill rates and the Truth Score™ (a score out of 100 for how far your data can be trusted). The memo cites a handful of sample records as evidence.
-
08What we delete
Your exports, after the engagement.
Every export you sent. What remains is the quality metrics and the memo, including the handful of sample records it cites as evidence.
What we keep, what we delete
We keep the measurement. Your exports go.
After an engagement, what stays with us is figures about your data and the memo itself. The memo cites a handful of sample records as evidence, so a finding can be checked; everything else you sent is deleted.
Deleted after the engagement
Kept
- Finance customers with no CRM account823
- Deals that reconcile to an invoice13%
- City recorded differently across systems3,128
- Truth Score59 · Band C
- Sample records cited in the memo as evidenceA handful
Kept figures from our sample memo: real engine output on generated test data, not a client. The deleted rows are made up for this page.
Where AI is used
No AI model decides the score. One helps with the reading and the wording.
The Truth Score is rule-based: the same data, scored on the same date, gives the same score, and no AI model decides it. We do use a language model (Anthropic’s Claude, through its commercial API) to read the plan or proposal you send and to help draft the memo’s wording from our findings. A person checks every line before it reaches you. If you’d rather we didn’t use it on your engagement, say so and we do that part by hand.
Rule-based. No model involved
- Matching customers, people, deals and invoices across your exports
- Every pillar score, the cap and the band
- Which findings are red flags, and the records behind each one
- The verdict, checked by hand and signed off by DataTruth
A language model helps. A person checks
- Reading the plan or proposal you send, to list the AI plays in it
- Drafting the memo’s wording from findings we have already made
- Every line checked by a person before it reaches you
- Switched off for your engagement if you ask: we do that part by hand
What we never ask for
No logins. No connections left open.
- Usernames, passwords or access to your systems
- Software installed on your network
- Connections that stay open between engagements
- Fields the decision doesn’t need: the field list is agreed first
What we don’t claim
No badges. Here is why.
We hold no formal security certifications, so we display none. Badges borrowed from the infrastructure we run on say nothing about how we handle your data. What we offer instead is the detail on this page, a data processing agreement signed before anything moves, and a plain written answer to your security questionnaire.
- Security questionnaireAnswered plainly, including what we don’t have.
- Data processing agreementSigned before any data moves; your template or ours. The full list of sub-processors comes with our data processing agreement, before any data moves.
- Questions about your datahello@getdatatruth.com. See also our privacy policy.
Questions
Security questions.
Anything else, ask on the 30-minute call. It commits you to nothing.
Book the callDo you put our data into an AI model?
The Truth Score is rule-based: the same data, scored on the same date, gives the same score, and no AI model decides it. We do use a language model (Anthropic’s Claude, through its commercial API) to read the plan or proposal you send and to help draft the memo’s wording from our findings. A person checks every line before it reaches you. If you’d rather we didn’t use it on your engagement, say so and we do that part by hand.
Do you need access to our systems?
No. One person on your team runs standard exports from the systems behind the decision and sends them under NDA. We send the exact field list first. Nobody at DataTruth logs in to anything and nothing is installed.
Will you sign our NDA and data processing agreement?
Yes. Both are signed before any data moves. If your legal team prefers its own templates, send them over and we will work from those.
What do you keep after the engagement?
We keep quality metrics and the memo. The memo cites a handful of sample records as evidence; your exports are deleted after the engagement.
Who are your sub-processors, and where do they process data?
The full list of sub-processors comes with our data processing agreement, before any data moves. It names each provider, what it does for us and the safeguard that covers any transfer outside the EU. Ask for it on the first call if your review needs it earlier.
Will our data go into a benchmark?
We never use your data or metrics derived from it in any benchmark without your written opt-in.
Will you complete our security questionnaire?
Yes, plainly, including what we don’t have. We hold no formal security certifications and we don’t display badges. We will tell you how exports reach us, who can see them, where a language model is used and when they are deleted.
Ask us anything before you send anything.
We will walk your finance, IT or legal lead through how exports reach us, how they are analysed and when they are deleted, on the first call.
Starts with a 30-minute call. Commits you to nothing.