We take security, privacy, and compliance seriously — whether you're a school district, law firm, or growing business. Here's how we protect your data.
Enterprise-grade protection, built in — not bolted on.
All data is encrypted at rest using AES-256 via Google Cloud's default encryption. Database storage, file uploads, and backups are all covered.
All connections use TLS 1.2+ encryption. API calls, file uploads, webhook callbacks, and browser sessions are all encrypted end-to-end.
Hosted on Google Cloud Platform (us-central1). Cloud Run for compute, Cloud SQL for PostgreSQL, with automatic scaling and redundancy.
Role-based access (Admin, User) with Google OAuth 2.0 authentication. Superadmin controls available for platform management. Session-based auth with secure tokens.
Strict multi-tenant isolation. Each organization's data — documents, forms, chat history, embeddings — is completely separated at the database level. No cross-tenant access.
OWASP-recommended security headers including Content Security Policy, X-Frame-Options, X-Content-Type-Options, HSTS, and referrer policy enforcement.
Different industries, different requirements. We build the controls — you choose which frameworks apply to you.
Regardless of your industry, every Heartbeat AI customer benefits from:
For K-12 schools, districts, and educational institutions:
Important note: FERPA compliance is a shared responsibility. Heartbeat AI provides the technical safeguards and contractual commitments. Schools are responsible for ensuring their use of the platform complies with their institutional policies and applicable law.
For professional services, SMBs, and enterprise customers:
For customers subject to the General Data Protection Regulation (GDPR) or similar international privacy laws:
Third-party services that process data on our behalf. We notify customers before adding new sub-processors.
| Service | Purpose | Data Processed | Location |
|---|---|---|---|
| Google Cloud Platform | Infrastructure (Cloud Run, Cloud SQL, Cloud Storage) | All platform data | US (us-central1) |
| Stripe | Payment processing | Billing info, payment method tokens | US |
| Google Gemini | AI language model (default) | Queries, document text for RAG | US |
| Google Drive API | Optional file sync integration | File metadata, content (when enabled) | US |
| Slack API | Optional Slack integration | Channel messages (when enabled) | US |
| QuickBooks API | Optional accounting integration | Invoice and customer data (when enabled) | US |
Note: AI provider integrations (OpenAI, Anthropic, Ollama) are optional and customer-configured. When you bring your own API key, queries are sent directly to that provider under your own terms of service with them.
Review and sign our agreements digitally. All forms are hosted on the Heartbeat AI platform itself.
Standard DPA covering data handling commitments, FERPA provisions, breach notification, and sub-processor obligations. Required for all customers processing personal data.
Review & Sign DPAService agreement covering account responsibilities, data ownership, acceptable use, billing, and liability terms.
Review & Sign ToSMutual NDA for partnerships, integrations, investment discussions, and consulting engagements.
Review & Sign NDANo. We never sell, rent, or share customer data with third parties for marketing or advertising. Your data is used solely to provide the Heartbeat AI service.
No. Customer data is never used to train, fine-tune, or improve AI models. When we use Google Gemini as the default AI provider, queries are processed under Google Cloud's enterprise terms which prohibit using customer data for model training.
Yes. You can export your documents, form entries, and chat history at any time. For full account deletion, contact us and we'll process the request within 30 days.
Heartbeat AI provides the technical safeguards and contractual commitments needed for FERPA compliance, including a DPA with FERPA-specific provisions. However, FERPA compliance is a shared responsibility — schools must ensure their use of the platform aligns with their institutional policies.
All data is stored in Google Cloud Platform's us-central1 region (Iowa, USA). Database backups are encrypted and stored in the same region.
We will notify affected customers within 72 hours of confirming a data breach, including details of what data was affected, what we're doing about it, and recommended actions.
Yes. You can configure your own API keys for OpenAI, Anthropic, Google Gemini, or even a self-hosted Ollama instance. When you bring your own key, queries go directly to that provider under your terms with them.