Security and data handling at Seenby

Seenby works by sending a frozen set of prompts about your brand to two providers, OpenAI and Perplexity, each week, and keeping the answers they return. That mechanic is most of the security question: which text leaves your side, what gets written down, and who can read it afterwards.

Seenby keeps six kinds of record, set out in the table below. Nothing else is collected, and each one exists because a specific part of the product would not work without it. The answers are the largest category, because the evidence behind a Share of AI Voice score is the answers themselves, and a score you cannot audit is not worth reporting.

Seenby has not launched. Join the waitlist using the form at the foot of this page, and read the rest of this first if a security questionnaire is waiting on it.

Six kinds of record. One AWS region. Six outside services. Download a copy, or delete everything, from Settings.

Seenby is hosted on Amazon Web Services. The application and its Postgres database run in a single AWS region.

You cannot pick that region. There is no choice of hosting region at signup, so if your procurement process requires data residency in a named country, treat this as a blocker today rather than a detail to settle later.

Amazon Web Services, one region, not selectable.

Sign-in is email and password. The password is stored hashed, and a session cookie keeps you signed in. The email address on the account is also the address password resets go to and the address the weekly digest is sent to.

There is no single sign-on. No SAML, no OIDC, so access is managed in Seenby rather than in your identity provider. If your security policy mandates SSO for third-party tools, that policy is not met yet, and we would rather you learn it here than in a questionnaire round.

Email and password, hashed, session cookie, no SAML, no OIDC.

Answers written by an AI model about a market will sometimes name real people: an executive, an analyst, a customer quoted somewhere. That is incidental to what Seenby measures, but it still lands in stored text, so it is handled in the pipeline rather than in a policy paragraph.

A scrubbing step runs inside the response-storage pipeline before any response becomes queryable, and every stored response carries a flag recording that it ran. Emails, phone numbers, handles and personal names are redacted at that point, so the readable answer log and the scoring layer both work on scrubbed text.

Be precise about what that buys you. Redaction of this kind works on patterns, so it reduces exposure rather than eliminating it, and it is not a claim that no name can ever survive a pass. It is the reason stored answers are not a growing pile of raw third-party text.

The answer log is built to show one stored AI answer with the emails, handles and personal names inside it redacted, and the pii_scrubbed flag visible on that record. Because the scrubbing step runs in the response-storage pipeline before any response is queryable, the version you read is the scrubbed one, tagged with the model version that produced it.

A signed-in customer can download a copy of their data and delete their account from Settings in the product. Deletion asks you to type the account's email address to confirm, and then the brand, its prompt set, every stored answer, the extractions, the scores and the digest history go in one transaction, with a live subscription cancelled in the same step. The same screen exports a JSON file of everything stored first, so you can take the record away before it goes.

Until then, answers and scores are kept for as long as the account exists, because the week-over-week trend is the product; deleting last quarter's answers would delete last quarter's comparison. Usage records are kept for 16 weeks. A shared provider-answer cache holds scrubbed answer text with no account or brand attached to it and expires within a day. Records Stripe must keep for tax purposes stay with Stripe after deletion.

Export a JSON file, then delete the account, both from Settings. Answers and scores last as long as the account. Usage records, 16 weeks.

Reporting a security problem

Seenby reads email at hello@kaleidoapps.com. That is the address for a security problem and for a request about a person's data, including the case where you cannot sign in and so cannot use Settings: write from the address on the account. Under UK GDPR, a request for a copy of a person's data or for its erasure is answered within one month, which is the law's rule rather than a service level of our own. The site's terms and privacy policy name the company that sells Seenby.

One caveat belongs next to any stored score: answers from these models are not deterministic and model versions change under you, which is why every stored answer carries its model version. A week-over-week move can reflect a model update rather than a real shift in the market.