data stored in the European Union, encryption in transit and at rest, GDPR compliance, listed subprocessors. Everything you need to know before trusting Pitchbase with your sales data.
Pitchbase is designed to keep user data inside the European Union. Here is the precise mapping.
Database + Auth
Supabase (PostgreSQL)
Europe region (Ireland, eu-west-1). Daily backups kept for 7 days.
Application hosting
Render
Frankfurt region (EU). Node.js Express + WebSocket service, integrated monitoring.
Audio files
Supabase Storage
Simulation recordings encrypted at rest, in private storage. Read only through a temporary link, issued after a server-side check to the rep or their manager.
Transactional email
IONOS SMTP (Germany)
Servers based in Germany, GDPR compliance. HMAC-signed unsubscribe links.
In transit
TLS 1.2 minimum, 1.3 preferred
Strict HTTPS (HSTS), WebSockets in wss://, automatically renewed certificates. No plaintext communication accepted.
At rest
AES-256 on database and files
Encryption managed by Supabase (disks + backups). Passwords: bcrypt with per-user salt (Supabase Auth).
Secrets and API keys
Render environment variables
No API key in source code. Production secrets are mandatory in NODE_ENV=production (server crash if missing).
Signed webhooks
Cryptographic verification
Stripe webhooks verified via mandatory HMAC signature. Unsubscribe tokens signed HMAC SHA-256.
Passwordless sign-in by default
Email magic link or Google OAuth via Supabase Auth. Pitchbase never stores passwords.
Server-side JWT sessions
All protected API routes verify the Supabase JWT. Voice WebSockets open with a single-use ticket, valid for 30 seconds.
Per-user isolation (anti-IDOR)
All resources (personas, deals, sessions, transcripts) filtered by user_id and checked server-side. The only exception, described below: a team's manager.
Field whitelisting (anti-Mass Assignment)
Update routes use an explicit allowlist of writable fields. No arbitrary database writes via request body.
Multi-account and teams
For teams, invitation by code. The manager and heads of sales access the training data of the reps in their space (scores, transcripts, feedback, pipeline, audio recordings), never beyond it. Each rep is told so by a notice when joining the team.
Pitchbase complies with the EU General Data Protection Regulation 2016/679. Here is how.
Roles: Pitchbase acts as data controller for individual accounts (you manage your own data) and as data processor for team subscriptions (your company stays the controller). A data processing agreement (GDPR Article 28) is offered to teams and schools with their contract.
Legal bases: contract performance (account creation, simulations), consent via the cookie banner (audience measurement and advertising), legitimate interest with opt-out at any time (nurture emails).
Your rights: access, rectification, deletion, portability, objection, restriction. Access and portability are self-service and immediate: Settings > Profile > "Export my data" downloads an Excel file (one tab per type of data: profile, simulations with transcripts and scores, prospects, deals, offer, progress…), also available as JSON to import into another tool. For the other rights, email contact@pitchbase.app: reply within 30 days, in practice within 7 business days.
Account deletion: from your Settings page, or by email. Immediate effect on production data; encrypted backups are kept for 7 days and then disappear. The only exception is legal retention (billing: 10 years).
Breach notification: in the event of a data breach, we notify the CNIL within 72 hours where the law requires it (GDPR Article 33) and tell you directly if the risk to you is high (Article 34). For teams and schools, we alert your organization without delay.
Pitchbase relies on technical subprocessors for hosting, AI and voice processing. None of our AI providers (OpenAI, Anthropic, Deepgram, Gradium) trains its models on your data.
| Subprocessor | Role | Location | Safeguards |
|---|---|---|---|
| Supabase | Database, authentication, recordings | EU (Ireland) | DPA with Standard Contractual Clauses |
| Render | Application hosting (Cloudflare network in front) | EU (Frankfurt) | DPA, Data Privacy Framework certified |
| OpenAI | Call analysis, feedback, persona generation from a description | US | No training on API data; kept up to 30 days for abuse prevention |
| Anthropic | LLM (persona responses in simulation, offer and practice prospects, account files, description of the shared screen during a video call) | US | No training on API data; kept up to 30 days; screen captures are kept neither by Pitchbase nor by Anthropic beyond the request; the rep's camera never leaves their browser |
| Deepgram | Speech recognition (transcription) | EU (European endpoint), US company | Signed DPA, training program disabled |
| Gradium | Voice synthesis (TTS) | France (EU) | Zero retention enabled, no transfer outside the EU |
| Stripe | Payment | EU (Ireland) / US | PCI DSS Level 1, Data Privacy Framework certified |
| IONOS | Transactional email | EU (Germany) | EU hosting, no transfer |
| Google (Analytics, Ads) | Audience measurement and advertising | US | Only loaded after consent (cookie banner, Consent Mode v2) |
| Meta | Advertising measurement (pixel) | US | Only loaded after consent (cookie banner) |
| Google (sign-in) | Sign-in with a Google account, if you choose it | US | Data Privacy Framework certified |
| Google Fonts, Unsplash, jsDelivr, unpkg, esm.sh, Tailwind CDN | Fonts, images and libraries loaded by the pages | US / global network | Receive the browser's IP address on page load, no other data |
Transfers to the United States rely on the EU-US Data Privacy Framework for certified providers (Google, Meta, Stripe, Render), and on the European Commission's Standard Contractual Clauses (2021) for the others (OpenAI, Anthropic, Deepgram, Supabase).
Personas, deals, transcripts: kept while your account is active. You can delete your prospects and deals from the interface; your simulation history is deleted with the account.
Audio recordings: every simulation is recorded for replay and feedback. Kept for a maximum of 90 days, purged automatically every day, deleted immediately with the account.
Technical logs: kept for a maximum of 12 months for debugging and security; in production they contain no conversation content (metrics only).
Billing data: kept 10 years (French legal requirement).
Account deletion: from the Settings page (Profile tab, "Delete my account"). Immediate purge of personal and production data; backups are kept for 7 days and then disappear.
HTTP headers
Helmet (CSP, HSTS, X-Frame)
Strict Content Security Policy on the app, with a per-request nonce. Forced HSTS. X-Frame-Options SAMEORIGIN (clickjacking protection).
Rate limiting
3 levels by sensitivity
Global 100 requests per minute, sensitive (payment, email, contact) 10 per minute, expensive (AI) 5 per minute.
Anti-XSS
Systematic HTML escaping
All dynamic content runs through a client-side escaper before DOM insertion. No uncontrolled HTML injection.
Upload validation
Type, size and owner checked
Recordings: audio formats only, 50 MB max, session owner check. Documents for your offer (PDF, TXT, MD, HTML, 8 MB): read in memory, only the text is kept.
Strict CORS
Production: pitchbase.app only
In NODE_ENV=production, only pitchbase.app and www.pitchbase.app are allowed to call the API.
Updates
Dependency monitoring
Known vulnerabilities are tracked (npm audit); security fixes take priority.
If you discover a security flaw in Pitchbase, please report it privately before any public disclosure. We commit to:
Contact: contact@pitchbase.app (subject "Security vulnerability").
Page last updated: September 2026.
Data hosted in the European Union, GDPR-compliant, encryption in transit and at rest. Free trial, 3 lifetime simulations, no credit card required.
Start freeOr book a demo for teams.