Where your data lives, and who can see it
This page says where PodData runs, what we keep, who processes it and who has access. Each fact was true on Nov 14, 2026.
Everything runs on Cloudflare
We own no servers. The product, its databases, its files and its email all run on Cloudflare.
One provider
Cloudflare runs our code, databases, file storage, search index and queues. It also sends our product email.
Staging apart from production
Every change runs on a separate staging copy first. It has its own databases and files, apart from production’s.
No fixed region yet
We haven’t asked Cloudflare to keep our data in one country or region. Cloudflare encrypts the databases and files it stores.
Only what the product needs
For each person on a team, we keep a short list. We never keep a password, because there isn’t one.
About you
Your email address, and your name and picture if you use Google. Your time zone and your team.
Your work
Your trackers, the quotes they matched and your feedback on them. What we delivered, and counts of use.
Keys and secrets
We keep API keys and session ids only as SHA-256 hashes. Webhook secrets and Slack or Microsoft Teams addresses are sealed with AES-GCM.
Quotes and transcripts
A quote runs at most 80 words in a row. We keep transcripts to find quotes, and neither the workspace nor the API shows one.
Audio and voices
A copy of a show’s feed audio is deleted within a day. Audio from a public video is kept so it’s fetched once. We never serve it, and we keep no voice prints.
Seeing or deleting it
Write to hello@poddata.ai to see, correct or delete what we hold about you.
No passwords at all
Only the addresses we’ve added can get in, with Google or with a link by email.
Google or an email link
A link by email works once and lasts 15 minutes. No Google script runs on our pages.
The session
Its cookie is HttpOnly, Secure and SameSite=Lax, and lasts 30 days. We store only a hash of its id.
The workspace’s pages
Every change you make is checked to come from our own pages. They send a strict content security policy and refuse to be framed.
The services that handle data for us
Each one does a set job. We don’t sell what you give us, or use it for advertising.
| Service | What it does for us | What it gets |
|---|---|---|
| Cloudflare | Hosting, databases, file storage, the search index, queues and product email. Its models turn speech into text and index text for search. | Everything the product stores. Podcast audio and text to process. Each product email. Visitors’ IP addresses. |
| Anthropic | Models that read the sentence behind a tracker and name the speakers in a transcript. | The sentence you write for a tracker. Passages of podcast transcripts. |
| OpenRouter, which passes the call to an OpenAI model | The yes or no check on each possible quote. | A podcast passage and the tracker it’s checked against. |
| Google Workspace | Our mailbox. | Email you send to hello@poddata.ai. |
| Slack | Where requests from this site’s forms reach our team. | What the demo, takedown and newsletter forms collect. |
| Google Analytics | Counting visits to this site, never the workspace. | What our privacy page lists. |
Your own Slack channel or webhook, if you set one, gets the quotes you asked for. The privacy page says what this site keeps.
One person, and each part only what it needs
PodData is a small company. One person, our founder, holds admin access to every system we run.
Your team’s data stays with your team
Every tracker belongs to a team. Each request is checked against the teams its sender belongs to.
Each part holds only its own keys
Only the parts that call models hold model keys. The workspace holds nothing but its session key.
No secrets in our code
Keys are set on Cloudflare and never written into our code. Every key is PodData’s own.
Every change is tested before it reaches you
Tests first
Every change is a pull request. Automated tests must pass before it merges.
Staging, then production
Each change goes to staging and is checked there with a smoke test. Only then does it reach production.
Undone by itself
If production’s smoke test fails, production goes back to the version before by itself.
No certifications yet
Buyers ask about these, so here is where we stand.
No SOC 2 report
We hold no SOC 2 report, ISO 27001 certificate or other certification. We’ve listed what a SOC 2 Type I audit asks for.
No penetration test
Nobody outside PodData has tested our security yet.
No written policies
How we build and ship is written down, but not yet as formal security policies.
How to report a problem
A security problem
Write to hello@poddata.ai with what you found and how to see it. We have no separate security address yet.
A security questionnaire
We keep answers to the CAIQ, a standard security questionnaire, for buyers. Write to us for a copy.
A quote about you
Use the takedown form to fix or remove a quote. We reply within three business days.
Running a security review?
Tell us what it asks for when you request a demo. We’ll answer from what’s true today.
Request a demo