How PrivateStack handles your data

Security & Data Handling

PrivateStack is operated by Data Science & Engineering Experts, Inc., a Delaware corporation registered to do business in Georgia, with operational headquarters in Atlanta. This summary explains our published commitments and the limits of the evidence available for a buyer review. Your signed agreement and DPA govern your deployment.

Content, storage, and retention

Prompts, outputs, conversations, uploads, and knowledge-base content are Tenant Content. Hosted processing is in the United States; Enterprise BYOC content resides in the customer cloud environment under its agreement. Embeddings and retrieved text require deployment-specific storage and deletion evidence; no separate expiry is promised here. Our published policy commits to purge live tenant data within 30 days after termination, retain account and billing records for 7 years and security and audit records for 2 years, and expire encrypted backups within 35 days. Legal holds can suspend deletion of affected records. Export is available during the 30-day termination window; deletion certification is available on request. These are contractual commitments, not proof of an automated purge. External onboarding requires a reviewed manual teardown path with deletion evidence. Read the retention policy.

Inference and service providers

The hosted offer describes US inference under contractual zero-retention and no-training terms. Those terms concern the inference provider, not every workspace store or backup. The public service-provider categories include inference, AWS hosting, identity, payments, analytics, diagnostics, and customer communications. Request the current vendor list, provider terms, regions, and model route in your DPA; do not infer the route from a tier name.

Tenant boundaries

The documented hosted architecture uses per-tenant workspaces and scoped access; Enterprise BYOC places the deployment in the customer-controlled AWS account. Architecture is not a current isolation test result. Request evidence for your deployment, including access boundaries and enabled model routes, before onboarding sensitive data.

Telemetry and Console analytics: verification limits

Our policy covers operational metrics, errors, feature usage, and API metadata separately from Tenant Content. Earlier on October 17, 2026, a review found Google measurement attempts before consent. After a Console update the same day, desktop and mobile checks of public sign-in pages found no Google or advertising requests in the tested consent and Global Privacy Control states. These checks did not use a real signed-in account; handling of authenticated identifiers and tenant-specific URLs remains unverified in live customer sessions. Self-hosted analytics could not be verified because its script was unavailable; operation and runtime payload handling remain unverified. Review your deployment's analytics disclosures and evidence before using sensitive data.

Incident contact and assurance

Report suspected incidents to security@privatestackhub.com. The published commitment is notification without undue delay as required by law and customer agreements; no fixed response-hours guarantee is stated here. Current, deployment-specific controls evidence is available on request. This summary is not an independent audit report.

Beta limits and support

The service is beta with no uptime guarantee. Do not use it as your sole system of record. Specially regulated data requires an appropriate signed agreement and confirmation that the configuration supports it. Air-gapped and supply-chain-verified deployments are outside the managed beta. Contact support@thedataexperts.us; confirm any response target in your agreement. Read the beta terms and data-use limits.