Your data security is our top priority.
That's why our entire architecture is built on systems you can trust.
Browse trust documentsOverview
Trust & Security
DecisionHub's software, architecture, and hosting stack have security and related features built in from end to end. Review DecisionHub’s security, privacy, service, and agreement information.
Data Protection & Privacy
Our Data Processing Addendum describes how we handle customer data, access, retention and incident response. Review those terms against your organization’s privacy and procurement requirements.
Transparent hosting
Our primary database and backups are hosted in Canada. Google Cloud services are being moved to a Canadian region, with completion scheduled by January 1, 2027. Until then, those services may process Customer Data in North America. AI processing uses a separate provider in the United States, as identified in Schedule 2 of our Data Processing Addendum.
Review the Sub-processors page for each provider’s purpose, data processed and location. We give at least 30 days’ advance notice before a new sub-processor begins processing Customer Data.
Your data is yours
Clients own their data. We use it only to run the platform. We never: sell it, use it for advertising, or use it to train AI models. Clients can export and delete their data from our system at any time.
After the term ends, you have 30 days to export your data. Active-system deletion is completed within 60 days after the term ends. Backups expire in their normal 35-day cycle and in all cases within 12 months after the term ends, subject to legally required retention.
Respect for privacy
Our Privacy Policy explains how we handle personal information. Customer program data is processed under the customer’s instructions and our Data Processing Addendum.
We notify customers without undue delay and in any event within 48 hours after becoming aware of a Security Incident.
Accounts and permission based access
Access is controlled by role and the permissions set by your organization. DecisionHub personnel access Customer Data from Canada only, through secured access controls and only as necessary to provide, support, maintain or recover the service.
Infrastructure & Platform
From encrypted connections to daily backups, DecisionHub is designed to keep your data protected, available, and recoverable.
Encryption everywhere
Connections use TLS encryption in transit. The database, file storage and backups are encrypted at rest through our hosting sub-processors, as described in the DPA’s security measures.
Reliability & backups
Our SLA sets a 99.5% monthly availability target. Encrypted daily database backups are stored in Canada and retained for 35 days. Recovery targets are an 8-hour RTO and a 24-hour RPO, not guarantees.
Governance & Operations
Our Data Processing Addendum sets out the security measures and operational responsibilities that apply to customer data.
Secure development
Our documented security measures include version-controlled code, review before release, and timely security updates to software and dependencies.
Privacy and procurement
Review our service terms, Data Processing Addendum and subprocessor information with your privacy or procurement team. Contact support@decisionhub.org with questions about your organization’s requirements.