Skip to content
Security and compliance

Security at Pitchbase

data stored in the European Union, encryption in transit and at rest, GDPR compliance, listed subprocessors. Everything you need to know before trusting Pitchbase with your sales data.

GDPR Data stored in the EU TLS 1.3 AES-256 at rest No AI training on your data

Hosting and infrastructure

Pitchbase is designed to keep user data inside the European Union. Here is the precise mapping.

Database + Auth

Supabase (PostgreSQL)

Europe region (eu-central-1). Automatic replication, daily 7-day backups, point-in-time recovery.

Application hosting

Render

Node.js Express + WebSocket service, automatic deployment from Git, integrated monitoring.

Audio files

Supabase Storage

Simulation recordings encrypted at rest. Per-user access enforcement (Row Level Security).

Transactional email

IONOS SMTP (Germany)

Servers based in Germany, GDPR compliance. HMAC-signed unsubscribe links.

Encryption and transport

In transit

TLS 1.3 on every connection

Strict HTTPS (HSTS), WebSockets in wss://, automatically renewed certificates. No plaintext communication accepted.

At rest

AES-256 on database and files

Encryption managed by Supabase (disks + backups). Passwords: bcrypt with per-user salt (Supabase Auth).

Secrets and API keys

Render environment variables

No API key in source code. Production secrets are mandatory in NODE_ENV=production (server crash if missing).

Signed webhooks

Cryptographic verification

Stripe webhooks verified via mandatory HMAC signature. Unsubscribe tokens signed HMAC SHA-256.

Authentication and access control

1

Passwordless sign-in by default

Email magic link or Google OAuth via Supabase Auth. Pitchbase never stores passwords.

2

Server-side JWT sessions

All protected API routes verify the Supabase JWT. Voice WebSockets are authenticated via query token before HTTP upgrade.

3

Per-user isolation (anti-IDOR)

All resources (personas, deals, sessions, transcripts) filtered by user_id server-side. No cross-account leak possible.

4

Field whitelisting (anti-Mass Assignment)

Update routes use an explicit allowlist of writable fields. No arbitrary database writes via request body.

5

Multi-account and teams

For teams (manager + reps), invitation by code. Managers access their reps' training data (scores, transcripts, feedback, recordings) within the limits of their organization; each rep is informed of this when joining the team.

GDPR compliance

Pitchbase complies with the EU General Data Protection Regulation 2016/679. Here is how.

Roles: Pitchbase acts as data controller for individual accounts (you manage your own data) and as data processor for team subscriptions (your company stays the controller). A Data Processing Agreement (DPA) is available on request for teams.

Legal bases: contract performance (account creation, simulations), consent via the cookie banner (audience measurement and advertising), legitimate interest with opt-out at any time (nurture emails).

Your rights: access, rectification, deletion, portability, objection, restriction. Exercise them by emailing contact@pitchbase.app. Reply within 30 days, in practice within 7 business days.

Account deletion: from your Account page, or by email. Immediate effect on production data; residues in encrypted backups are purged within 30 days, unless legal retention applies (billing: 10 years).

Breach notification: in the event of a data breach affecting your personal information, you will be notified by email within 72 hours, in line with GDPR Article 34.

Subprocessors and non-EU transfers

Pitchbase relies on technical subprocessors for generative AI and voice processing. None of them uses your data to train their models.

Subprocessor Role Location Safeguards
SupabaseDatabase, auth, storageEU (Frankfurt)Signed DPA, ISO 27001, SOC 2
RenderApplication hostingEU / USDPA, SOC 2 Type II
OpenAICall analysis, AI content generation (personas, feedback)USZero-retention API, no training
AnthropicLLM (persona responses in simulation)USNo training on API data
DeepgramSpeech recognition (STT)USEphemeral processing, no audio storage
CartesiaVoice synthesis (TTS)USNo training on generated outputs
GradiumVoice synthesis (TTS)France (EU)Ephemeral processing
StripePaymentEU (Ireland) / USPCI DSS Level 1, BCR validated by CNIL
IONOSTransactional emailEU (Germany)BSI C5-certified hoster
Google (Analytics, Ads)Audience measurement and advertisingUSOnly loaded after consent (cookie banner, Consent Mode v2)
MetaAdvertising measurement (pixel)USOnly loaded after consent (cookie banner)

Transfers to US-based subprocessors rely on the European Commission's Standard Contractual Clauses (SCC 2021), supplemented by the EU-US Data Privacy Framework when certification is in place.

Data lifecycle

Personas, deals, transcripts: kept while your account is active. You can delete each resource individually at any time from the interface.

Audio recordings: every simulation is recorded for replay and feedback. Kept for a maximum of 90 days, purged automatically every day, deleted immediately with the account.

Technical logs: kept for a maximum of 12 months for debugging and security; in production they contain no conversation content (metrics only).

Billing data: kept 10 years (French legal requirement).

Account deletion: from the Account page ("Delete my account" section). Immediate purge of personal and production data, backup residues within 30 days.

Application security

HTTP headers

Helmet (CSP, HSTS, X-Frame)

Strict Content Security Policy (explicit CDN allowlist). Forced HSTS. X-Frame-Options DENY (clickjacking protection).

Rate limiting

3 levels by sensitivity

Global 100 req/15min, sensitive (payment, email, contact) 20 req/15min, expensive (AI) 10 req/15min.

Anti-XSS

Systematic HTML escaping

All dynamic content runs through a client-side escaper before DOM insertion. No uncontrolled HTML injection.

Upload validation

MIME type + ownership check

Audio uploads only (MIME audio/*), session UUID validation, user_id check, path traversal protection.

Strict CORS

Production: pitchbase.app only

In NODE_ENV=production, only pitchbase.app and www.pitchbase.app are allowed to call the API.

Updates

Weekly npm audit

CVE monitoring (npm audit + GitHub Dependabot), security patches applied within 72 hours for CVSS above 7.

Reporting a vulnerability (Responsible Disclosure)

If you discover a security flaw in Pitchbase, please report it privately before any public disclosure. We commit to:

  • Acknowledge receipt within 48 business hours.
  • Assess and qualify the vulnerability (CVSS) within 5 business days.
  • Patch within a timeline proportional to severity: 24 hours for critical issues (CVSS above 9), 7 days for high (CVSS 7 to 9), 30 days for medium.
  • Publicly thank you (with your consent) on this page once the patch is deployed.

Contact: contact@pitchbase.app (subject "Security vulnerability").

Page last updated: April 2026.

Ready to try Pitchbase?

Data hosted in the European Union, GDPR-compliant, encryption in transit and at rest. Free trial, 3 lifetime simulations, no credit card required.

Start free

Or book a demo for teams.