Data Handling
betterfound is explicit about what it stores, for how long, and who can access it. This page covers the data handling commitments that apply to every tenant.
What betterfound stores
| Data | Stored | Retention | Notes |
|---|---|---|---|
| Product catalogue index | Yes — encrypted at rest | Until data source removed | Rebuilt on each sync |
| Enrichment vocabulary | Yes | Until re-enrichment overwrites | Tag list derived from your products |
| Fetch agent request logs | Yes | 30 days, then purged | Tenant ID, timestamp, URL hash, response status. No page content stored. |
| Widget session data | Yes | 30 days, then purged | Anonymised conversation turns for ops debugging |
| Page text from fetch_url | No | Volatile memory only | Held in RAM long enough to send to the LLM, then discarded |
| API keys / secrets | Yes — encrypted at rest | Until rotated or tenant deleted | AES-256 encryption, keys stored in AWS KMS |
| LLM prompts and responses | No | Not persisted | Anthropic does not train on API data per their ToS (eff. Sep 2024) |
LLM and Anthropic data policy
betterfound uses Claude (Anthropic) for the conversational AI. Anthropic's API Terms of Service (effective September 2024) explicitly prohibit Anthropic from using API request/response data to train models. Your product data and your shoppers' queries are never used to improve any AI model.
EU-tier tenants are routed to Anthropic's EU API endpoint. A DPA (Data Processing Agreement) covering Anthropic is available from your betterfound account manager.
Encryption
- In transit: TLS 1.2+ for all connections (1.3 where supported)
- At rest: AES-256 for all stored data
- Secrets: Per-tenant secrets stored encrypted using AWS KMS with envelope encryption
Access controls
- All betterfound infrastructure access requires MFA
- Production access is logged and audited
- No betterfound employee can access your raw product data or conversation logs directly — only via audited tooling with ticket-based approval
Certifications
| Certification | Status | Available to customers |
|---|---|---|
| SOC 2 Type II | Active | Report available under NDA |
| GDPR | Compliant | DPA available on request |
| ISO 27001 | In progress — Q4 2026 | — |
Deletion and offboarding
When you delete a data source or close your tenant account, betterfound purges all associated data within 72 hours. This includes the product index, enrichment vocabulary, session logs, and all stored credentials. A deletion confirmation email is sent when the purge completes.