Trust Center
Security & privacy at MYCONTENTLAB
Agencies trust us with their clients’ data and brand work. This page explains where that data lives, how it is isolated and encrypted, what our AI features do with it, and how to request the documents your review needs.
- Hosted in the EU on Supabase managed infrastructure
- Prompts and outputs are not used to train AI models
- Tenant isolation enforced by PostgreSQL Row-Level Security
AT A GLANCE
The controls behind every workspace
Included in every plan, for your team and for the clients you invite.
EU data hosting
Core services and databases run in an EU region (AWS Frankfurt) on Supabase managed infrastructure.
Encrypted in transit and at rest
TLS 1.2+ on web traffic, webhooks and APIs. AES-256 for database volumes and snapshots.
Database-level isolation
PostgreSQL Row-Level Security scopes queries to your organisation and denies access by default.
No training on your data
Prompts and generated outputs are not used to train or fine-tune foundation models.
Prompt redaction
API keys, card numbers, email addresses and phone numbers are stripped before text reaches an AI model.
Two-factor authentication
TOTP 2FA for every user, with team-wide enforcement on Agency and Enterprise.
Client-level permissions
Clients see only their own workspace, with each portal section set to Hidden, View or Act.
Read-only AI assistant access
MCP connections can read data but never create, change or delete it. Tokens are scoped and revocable.
AI GOVERNANCE
Your clients’ data does not train AI models
Generative features run through commercial model APIs, with clear limits on what is sent, kept and logged.
Commercial API terms
No model training
Content Lab, creative analysis and AI reports call foundation models through Google Cloud Vertex AI and Anthropic’s commercial APIs. Under those terms, your prompts, brand voice, briefs and client data are not used to train their models.
Before inference
Sensitive data redacted from prompts
Before any text leaves our servers, automated filters remove API keys and OAuth secrets, payment card numbers (checked with the Luhn algorithm), email addresses and phone numbers.
Owner controls
Controlled, logged AI usage
Owners choose which AI capabilities their team can use – Content Lab, video creative analysis and data chat. Each AI call is logged with model, token count and cost. Raw prompts and outputs are pruned after 30 days and deleted after 90.
AI Visibility (GEO) checks work differently: to measure whether a brand is recommended, they send brand names, competitor names and industry questions to the AI assistants being measured – ChatGPT, Claude, Gemini and Perplexity.
Infrastructure
Hosted in the EU, encrypted in transit and at rest
Core services and databases run on Supabase managed infrastructure in AWS Frankfurt.
- TLS 1.2 and 1.3 on all web traffic, webhooks and API gateways
- AES-256 encryption for database volumes and daily snapshots
- Meta, Google and LinkedIn OAuth tokens encrypted with AES-GCM before storage
- Row-Level Security scoped by organisation, configured to deny by default
- Passwords hashed with bcrypt / Argon2
Team access
Control who on your team can get in
Owners and managers decide who can access the agency workspace, and access changes leave a trail.
- TOTP two-factor authentication for every user
- Require 2FA for the whole team with one switch (Agency and Enterprise)
- Audit logs for permission changes, exports and admin actions
- Connections Hub credentials are visible to the agency team only
Client & AI access
Clients see their workspace – and nothing else
A client contact invited to one workspace cannot open another client’s workspace, your platform credentials, API keys, billing or margins.
- Hidden, View or Act access set per portal section
- Share links with an optional 4–8 digit PIN, expiry date and one-click revoke
- MCP access for AI assistants is read-only
- Personal access tokens scoped by workspace and permission, expiring after 30, 90 or 365 days
Business continuity
Documented recovery and incident response
Recovery targets, backups and breach procedures are defined in advance, not improvised.
- Recovery Time Objective (RTO): 8 hours
- Recovery Point Objective (RPO): 4 hours
- Daily encrypted backups with point-in-time recovery
- Incident procedure covering containment, root-cause analysis and GDPR 72-hour notification
DATA RETENTION
How long we keep your data
A summary of our retention rules. The privacy policy and data deletion pages are the authoritative versions.
| Data | How long we keep it |
|---|---|
| Account data | While your account is active, then up to 12 months after closure |
| Synced platform analytics | The historical window of your plan: 12 months standard, 24 months on Agency |
| OAuth tokens | Until you disconnect the platform, delete your account or revoke the token at the source |
| Raw AI prompts and outputs | Pruned after 30 days, deleted after 90 days |
| Encrypted off-site backups | 30 days |
| Billing records | 7 years (UK statutory retention) |
| Deletion requests | Acknowledged within 72 hours, completed within 30 days |
SUB-PROCESSORS
Who processes data on our behalf
Third parties that help us deliver the service. Transfers outside the UK / EEA are covered by the UK IDTA, EU Standard Contractual Clauses or an equivalent mechanism.
Supabase / Lovable Cloud
Database, authentication and storage hosting
EU
Google Cloud (Vertex AI)
AI model inference for generative features
Anthropic
AI model inference for generative features
Stripe
Payment processing
US · SCCs
Resend
Transactional email delivery
US · SCCs
When you connect Google, Meta, LinkedIn, Pinterest or TikTok, your data is fetched from their APIs under their own terms.
SECURITY IN EVERY PLAN
Core protection in every plan, governance as you grow
Every plan includes encryption, tenant isolation, no AI model training, prompt redaction and individual 2FA. Higher plans add team governance and compliance paperwork.
| Feature | Creator | Freelancer | Agency | Enterprise |
|---|---|---|---|---|
| Encryption, tenant isolation and prompt redaction | Included | Included | Included | Included |
| No AI model training on your data | Included | Included | Included | Included |
| Individual TOTP two-factor authentication | Included | Included | Included | Included |
| Team-wide 2FA enforcement | Not included | Not included | Included | Included |
| AI module governance | Not included | Not included | Included | Included |
| Access and permission audit logs | Not included | Not included | Included | Included |
| Data Processing Agreement | Not included | Not included | Standard DPA | Custom DPA |
| Advance notice of sub-processor changes | Not included | Not included | Not included | Included |
| Security and vendor assessment support | Not included | Not included | Not included | Dedicated |
DOCUMENTS
Security documents on request
Running a vendor or procurement review? Email us and we will send what your process needs.
- Data Processing Agreement (DPA)
- Sub-processor list
- Security architecture overview
- Incident response summary
Report a vulnerability
If you believe you have found a security issue, email us with the steps to reproduce it. Please give us reasonable time to investigate and fix it before any public disclosure.
security@mycontentlab.ai
Security questions
Short answers for IT, compliance and procurement teams. Need more detail? Request our security documents.
No. Generative features call foundation models through Google Cloud Vertex AI and Anthropic’s commercial APIs, under terms that exclude customer prompts and outputs from model training. Sensitive data such as API keys, card numbers, emails and phone numbers is redacted before a prompt is sent.
Core services and databases run on Supabase managed infrastructure in an EU region (AWS Frankfurt). Some sub-processors, such as Stripe and Resend, are outside the UK / EEA; those transfers are covered by the UK IDTA or EU Standard Contractual Clauses.
No. Every query is scoped to your organisation by PostgreSQL Row-Level Security, and client portal users only see the workspace they were invited to, with the sections you allow.
Only read. MCP tools can look up clients, metrics, mentions, trends, CRM summaries and Content Lab ideas, but cannot create, change or delete anything. Access uses OAuth or a personal access token that you scope, set to expire and can revoke at any time.
Agency plans include our standard DPA and Enterprise plans can sign a custom one. Email security@mycontentlab.ai to request it.
Email security@mycontentlab.ai with the steps to reproduce it. Please give us reasonable time to fix the issue before disclosing it publicly.