Our Security and Privacy Protocols
We pride ourselves on maintaining your data in a safe and trustworthy environment, having implemented controls and best practices to provide the highest standard of security for our users.
Last updated: August 26, 2026.
Data privacy
Securing access to data starts with people — and we invest a lot of time in hiring the best. Our teams are made up of professionals with experience building highly secure, enterprise-scale applications for companies of all sizes, from startups to large public companies.
At ChartMogul, we train all employees (regardless of their role) on up-to-date security policies and industry standards.
In addition, we monitor, log, and continuously review all employee access to your data.
Data Access
Your data is your property, and we’ll never sell it to anybody. We will only access your ChartMogul account with your permission — or if we detect suspicious activity or believe our Terms of Service are being violated.
GDPR Compliant
ChartMogul and all our third-party providers comply with the EU’s General Data Protection Regulation.
See Our Privacy PolicyCredit Cards
We do not process sensitive credit card details belonging to you or your customers.
Passwords
We encrypt all passwords before storing them in our database. You are responsible for choosing a strong password and keeping it secret. Two-factor authentication is available to all ChartMogul users, and we strongly recommend enabling it as an additional layer of security.
Our Data Processing Agreement is core to data security.
Review DPAWe craft security by design
We train our developers in secure software development practices.
Additionally, we use automated code analysis solutions in our development pipeline to ensure vulnerabilities aren’t introduced to our codebase.
Our security team takes part in both the design and implementation of any new feature that could increase our attack surface.
Encryption in transit and at rest
Data sessions are always protected with TLS protocols. Our databases are encrypted at rest, following industry standards.
SOC 2 Report
We have our SOC 2 Type 2 report and regularly submit to external audits to demonstrate continued compliance. To request our most recent SOC 2 report, please sign our NDA here.
Security assessments
We carry out continuous security code reviews, and do annual penetration testing to ensure the integrity of our platform.
Incident response plan
We follow SANS Incident Response methodology to handle incidents happening on our platform. We run a comprehensive post-mortem on each incident in order to both prevent such incidents from happening again and improve our remediation actions.
Request our latest SOC 2 Report
Request ReportAI & Data
ChartMogul's AI features are built with the same security and privacy principles as the rest of our platform. We've designed them to provide useful insights while protecting your data and keeping you in control.
Your data is not used to train AI models
ChartMogul does not use your data to train, fine-tune, or build AI models, and neither do the AI services we use.
Secure AI processing through Amazon Bedrock
ChartMogul uses Anthropic Claude and Amazon Nova models through Amazon Bedrock, AWS's managed AI service. We do not send your data directly to Anthropic or other model providers.
AI processing takes place in the EU
AI processing takes place within AWS infrastructure in the EU, using Amazon Bedrock's EU-only configuration.
Your existing access controls still apply
ChartMogul AI respects the same account and user permissions as the rest of the platform. Our AI assistant is read-only and cannot create, edit, or delete your data.
Infrastructure and platform resiliency
ChartMogul is fully hosted on AWS within the Europe region.
In our network topology, we make use of:
- Cloudflare as our network and web application firewall.
- Amazon VPC to segment our internal network.
We monitor our networks using a variety of solutions, including Cloudflare, Datadog and Sysdig.
24x7 monitoring
Our engineering team performs on-call rotations to monitor application, software, and infrastructure using best-of-breed services that are highly reliable and compliant with industry standards.
99.9% uptime
ChartMogul’s availability consistently exceeds 99.9%.
See Our Status PageDisaster recovery
We back up all customer data using replicas with additional backup snapshots.
Fault tolerance
Our architecture provides multiple failover instances to prevent outages due to single points of failure.
Our Security and Privacy Protocols
Terms of Service
ChartMogul maintains publicly-available Terms of Service that further detail our security commitments to our users.
Learn more about ChartMogul's Terms of ServicePrivacy Policy
ChartMogul maintains a publicly-available Privacy Policy that describes our privacy commitments to and the rights of our users and website visitors.
Learn more about ChartMogul's Privacy PolicyCommon Security FAQs
Need help with some common questions? Click below to browse our FAQs.
See FAQChartMogul Status Page
Click below to stay informed about our current operational status and eventual incidents.
Learn more about ChartMogul's operational statusRequest SOC 2 Report
ChartMogul continuously monitors security controls and undergoes external audits to demonstrate SOC 2 compliance. You can request our most recent SOC 2 report at the link below.
Learn more about ChartMogul's SOC 2 complianceQuestions?
Have questions, or want to learn more? Our team is ready to help!
Contact usFrequently Asked Questions
I am a ChartMogul customer, and there is suspicious activity in my account. What should I do?
Please contact us immediately.
I am a security researcher, and I’ve found a vulnerability in ChartMogul. How can I report it?
At ChartMogul, we welcome input from and are happy to work with security researchers. Please review our Vulnerability Disclosure Policy for more information on reporting security vulnerabilities.
Where does ChartMogul physically store my data?
ChartMogul production infrastructure lives entirely on AWS (Amazon Web Services). All the persistent data (databases, file storage, temp data) along side with compute power (web servers, processing machines, etc) are running in AWS EU Ireland Region (eu-west-1).
We store backups in AWS S3 using the same AWS Region: eu-west-1.
Is ChartMogul certified for PCI-DSS Level 1/2?
PCI-DSS is a security standard that any company that handles credit card data must comply with.
ChartMogul itself has not been audited by a PCI-certified auditor. That is because we use Stripe and Recurly to manage our subscription billing, and they handle all credit card data. Stripe and Recurly are compliant with PCI-DSS Level 1.
When handling your customers’ data to provide analytics, ChartMogul does not receive sensitive credit card details (at most, the last 4 digits of a credit card number).
What data does ChartMogul AI process?
The data processed depends on the feature.
When someone on your team asks the AI assistant a question, it processes the question, relevant conversation and user context, and the information from your ChartMogul account needed to answer it. This may include metrics, customer records, invoices, notes, tasks, and other relevant account data. The assistant accesses the information relevant to the request rather than your entire account.
Some AI-generated features analyze data already imported into ChartMogul, such as emails, notes, or call records, to generate insights such as topics or sentiment. Where relevant, the information processed may include personal data such as names and email addresses.
In all cases, existing ChartMogul user permissions continue to apply.
Where are AI conversations stored and how long are they retained?
AI conversation history is stored in ChartMogul's own infrastructure, alongside the rest of your account data. It is not shared with the companies that provide the underlying AI models.
AI conversations are not visible to other users on the same ChartMogul account. They are retained while your account remains active unless you delete them earlier. Users can delete individual conversations from their history, and conversation data is removed as part of our account data deletion process.