Hosting and infrastructure
Pitchbase is designed to keep user data inside the European Union. Here is the precise mapping.
- Database + AuthSupabase (PostgreSQL)
Europe region (Ireland, eu-west-1). Daily backups kept for 7 days.
- Application hostingRender
Frankfurt region (EU). Node.js Express + WebSocket service, integrated monitoring.
- Audio filesSupabase Storage
Simulation recordings encrypted at rest, in private storage. Read only through a temporary link, issued after a server-side check to the rep or their manager.
- Transactional emailIONOS SMTP (Germany)
Servers based in Germany, GDPR compliance. HMAC-signed unsubscribe links.
Encryption and transport
- In transitTLS 1.2 minimum, 1.3 preferred
Strict HTTPS (HSTS), WebSockets in wss://, automatically renewed certificates. No plaintext communication accepted.
- At restAES-256 on database and files
Encryption managed by Supabase (disks + backups).
- Secrets and API keysRender environment variables
No API key in source code. Production secrets are mandatory in NODE_ENV=production (server crash if missing).
- Signed webhooksCryptographic verification
Stripe webhooks verified via mandatory HMAC signature. Unsubscribe tokens signed HMAC SHA-256.
Authentication and access control
- Passwordless sign-in by default
Email magic link or Google OAuth via Supabase Auth. Pitchbase never stores passwords.
- Server-side JWT sessions
All protected API routes verify the Supabase JWT. Voice WebSockets open with a single-use ticket, valid for 30 seconds.
- Per-user isolation (anti-IDOR)
All resources (personas, deals, sessions, transcripts) filtered by user_id and checked server-side. The only exception, described below: a team's manager.
- Field whitelisting (anti-Mass Assignment)
Update routes use an explicit allowlist of writable fields. No arbitrary database writes via request body.
- Multi-account and teams
For teams, invitation by code. The manager and heads of sales access the training data of the reps in their space (scores, transcripts, feedback, pipeline, audio recordings), never beyond it. Each rep is told so by a notice when joining the team.
GDPR compliance
Pitchbase complies with the EU General Data Protection Regulation 2016/679. Here is how.
Roles: Pitchbase acts as data controller for individual accounts (you manage your own data) and as data processor for team subscriptions (your company stays the controller). A data processing agreement (GDPR Article 28) is offered to teams and schools with their contract.
Legal bases: contract performance (account creation, simulations), consent via the cookie banner (audience measurement and advertising), legitimate interest with opt-out at any time (nurture emails).
Your rights: access, rectification, deletion, portability, objection, restriction. Access and portability are self-service and immediate: Settings > Profile > "Export my data" downloads an Excel file (one tab per type of data: profile, simulations with transcripts and scores, prospects, deals, offer, progress…), also available as JSON to import into another tool. For the other rights, email contact@pitchbase.app: reply within 30 days, in practice within 7 business days.
Account deletion: from your Settings page, or by email. Immediate effect on production data; encrypted backups are kept for 7 days and then disappear. The only exception is legal retention (billing: 10 years).
Breach notification: in the event of a data breach, we notify the CNIL within 72 hours where the law requires it (GDPR Article 33) and tell you directly if the risk to you is high (Article 34). For teams and schools, we alert your organization without delay.
Sub-processors and non-EU transfers
Pitchbase relies on technical sub-processors for hosting, AI and voice processing. None of our AI providers (OpenAI, Anthropic, Deepgram, Gradium) trains its models on your data.
| Sub-processor | Role | Location | Safeguards |
|---|---|---|---|
| Supabase | Database, authentication, recordings | EU (Ireland) | DPA with Standard Contractual Clauses |
| Render | Application hosting (Cloudflare network in front) | EU (Frankfurt) | DPA, Data Privacy Framework certified |
| OpenAI | Call analysis, feedback, persona generation from a description | US | No training on API data; kept up to 30 days for abuse prevention |
| Anthropic | LLM (persona responses in simulation, offer and practice prospects, account files, description of the shared screen during a video call) | US | No training on API data; kept up to 30 days; screen captures are kept neither by Pitchbase nor by Anthropic beyond the request; the rep's camera never leaves their browser |
| Deepgram | Speech recognition (transcription) | EU (European endpoint), US company | Signed DPA, training program disabled |
| Gradium | Voice synthesis (TTS) | France (EU) | Zero retention enabled, no transfer outside the EU |
| Stripe | Payment | EU (Ireland) / US | PCI DSS Level 1, Data Privacy Framework certified |
| IONOS | Transactional email | EU (Germany) | EU hosting, no transfer |
| Google (Analytics, Ads) | Audience measurement and advertising | US | Only loaded after consent (cookie banner, Consent Mode v2) |
| Meta | Advertising measurement (pixel) | US | Only loaded after consent (cookie banner) |
| Google (sign-in) | Sign-in with a Google account, if you choose it | US | Data Privacy Framework certified |
| Google Fonts, Unsplash, jsDelivr, unpkg, esm.sh, Tailwind CDN | Fonts, images and libraries loaded by the pages | US / global network | Receive the browser's IP address on page load, no other data |
Transfers to the United States rely on the EU-US Data Privacy Framework for certified providers (Google, Meta, Stripe, Render), and on the European Commission's Standard Contractual Clauses (2021) for the others (OpenAI, Anthropic, Deepgram, Supabase).
Data lifecycle
Personas, deals, transcripts: kept while your account is active. You can delete your prospects and deals from the interface; your simulation history is deleted with the account.
Audio recordings: every simulation is recorded for replay and feedback. Kept for a maximum of 90 days, purged automatically every day, deleted immediately with the account.
Technical logs: kept for a maximum of 12 months for debugging and security; in production they contain no conversation content (metrics only).
Billing data: kept 10 years (French legal requirement).
Account deletion: from the Settings page (Profile tab, "Delete my account"). Immediate purge of personal and production data; backups are kept for 7 days and then disappear.
Application security
- HTTP headersHelmet (CSP, HSTS, X-Frame)
Strict Content Security Policy on the app, with a per-request nonce. Forced HSTS. X-Frame-Options SAMEORIGIN (clickjacking protection).
- Rate limitingSeveral levels depending on sensitivity
Payment, sending emails, the contact form and AI calls have stricter limits than the rest of the site.
- Anti-XSSSystematic HTML escaping
All dynamic content runs through a client-side escaper before DOM insertion. No uncontrolled HTML injection.
- Upload validationType, size and owner checked
Recordings: audio formats only, 50 MB max, session owner check. Documents for your offer (PDF, TXT, MD, HTML, 8 MB): read in memory, only the text is kept.
- Strict CORSProduction: pitchbase.app only
In NODE_ENV=production, only pitchbase.app and www.pitchbase.app are allowed to call the API.
- UpdatesDependency monitoring
Known vulnerabilities are tracked (npm audit); security fixes take priority.
Reporting a vulnerability (Responsible Disclosure)
If you discover a security flaw in Pitchbase, please report it privately before any public disclosure. We commit to:
- Acknowledge receipt within 48 business hours.
- Assess and qualify the vulnerability (CVSS) within 5 business days.
- Patch within a timeline proportional to severity: 24 hours for critical issues (CVSS above 9), 7 days for high (CVSS 7 to 9), 30 days for medium.
- Publicly thank you (with your consent) on this page once the patch is deployed.
Contact: contact@pitchbase.app (subject "Security vulnerability").
Frequently asked questions.
Another question? Write to us at contact@pitchbase.app.
Where is Pitchbase data hosted?
All user data (accounts, personas, transcripts, scores) is hosted in the European Union via Supabase (Europe region). The application is hosted by Render, Frankfurt region (EU). Some AI processing (transcription, reply generation, call analysis) goes through US providers, covered by the European Commission's Standard Contractual Clauses.
Is Pitchbase GDPR compliant?
Yes. Pitchbase acts as data controller for individual accounts and as data processor for team subscriptions. You can exercise your rights to access, rectification, deletion and portability by emailing contact@pitchbase.app. Exporting your data and deleting your account are also self-service from the Settings page, with immediate effect: for deletion, immediate effect on production data; daily backups, kept for 7 days, then disappear on their own.
Are voice recordings stored?
Yes: every simulation is recorded (audio) to enable replay and feedback. Recordings are kept for a maximum of 90 days then deleted automatically, and deleted immediately with the account. Text transcripts are kept while the account is active. All audio files are encrypted at rest.
Which sub-processors handle my data?
Supabase (database, authentication and recordings, EU), Render (application hosting, EU), OpenAI (call analysis and AI content, US, no training on data), Anthropic (prospect replies in simulation, offer and practice prospects, account files, US, no training on data), Deepgram (transcription, European endpoint, no training), Gradium (voice synthesis, France), Stripe (payment, EU/US), IONOS (email, EU), Google (Google sign-in, audience measurement after consent, US) and Meta (advertising measurement after consent, US). The full list is updated whenever a sub-processor is added.
How do I report a security vulnerability?
Email a detailed description to contact@pitchbase.app with the subject 'Security vulnerability'. We acknowledge receipt within 48 business hours and publish a patch within a timeline proportional to severity (24h for critical issues).
Try Pitchbase on your own offer.
Thirty minutes to discover Pitchbase and see if it fits your needs. If it does, we set it up for your team right after.
Prefer to try it alone? 5 free simulations