Privacy Policy

Last updated: 17 October 2026

What we collect

• Account data: the organisation name, administrator email and user accounts created in your workspace.
• Billing data: subscription and payment status. Card details are handled by Stripe and never reach our servers.
• Workspace content: the compliance, risk and evidence data you enter. We process this only for you.
• Technical logs: IP addresses, request logs and error logs, used for security and reliability.

How we use it

We use this data to provide and secure the Service, bill subscriptions, send service emails (such as login details and payment notices) and give support. We do not sell personal data.

Where it is stored

Each workspace has its own isolated database on our servers. Backups are taken nightly and kept for a limited period.

Sub-processors

• Stripe: payment processing
• Our hosting provider: infrastructure
• OpenRouter and the AI model providers it routes to: only for content you explicitly send to an AI assistance feature
• Our email delivery provider: transactional emails

Retention

Workspace data is kept for as long as your subscription is active. After suspension it is kept for a limited period and then deleted. Billing records are kept for as long as the law requires.

Your rights

Depending on where you are, you may have the right to access, correct, export or delete your personal data. To exercise these rights, email privacy@isoharbor.com.

Contact

privacy@isoharbor.com