What we do with your data, and what we don’t have yet.

We connect to your warehouse

Your data stays in your cloud project. We read it across the project boundary, and the only permission you grant is read access on the specific tables in scope — for a BigQuery warehouse, that is the Data Viewer role and nothing more. We do not hold a credential inside your environment, and you do not hold one inside ours.

You send it

Files land in a private bucket and are parsed into your own raw dataset. Every row carries the id of the delivery it arrived in, so a corrected re-send supersedes exactly its predecessor rather than sweeping a date range — which means an undo is precise and auditable rather than a best guess.

We pull it

Acquiring and shaping retail data is the thing this team did for years before it was a product. If a source has no warehouse behind it, that is scope, not a disqualification.

A client is a set of datasets, not a table prefix

Each client gets its own raw, semantic, model and share datasets. The reason is the failure mode rather than the diagram: under shared tables with name prefixes, a mis-resolved table name is a cross-tenant read. Under separate datasets, the same mistake is a “table not found” error.

A dataset is also the smallest unit our warehouse can attach permissions to, which is what makes offboarding a single delete of a container rather than a carefully reviewed cleanup script.

Service accounts are scoped by function, and hold no downloaded keys

Separate machine identities run the pipeline, the ingest path, the app, the export job and the spreadsheet builder, each with least-privilege grants. The app that serves the portal holds no write role on any client dataset — it should not be able to alter warehouse data even by accident.

No key files exist to leak. People reach production permissions by impersonation, deployments authenticate through federated identity with no stored secret, and even the signed links in your email are signed through a credentials API rather than with a private key sitting on a disk.

Your team sees views, not tables

When your analysts want the underlying numbers, they get a share dataset of authorized views named in your own vocabulary — weekly sales, brand and category rollups, and the log of every finding we have raised. That share dataset is the only one anyone on your side is ever granted, and your team never holds warehouse credentials at all: the spreadsheet connects on our identity, not on theirs.

No password exists

Signing in to the portal means entering your work email and getting a link that expires in twenty minutes and opens a session lasting fourteen days. There is no password column in the database — nothing to phish, reuse, or leak. The sign-in form answers identically for an address we know and one we do not, so it cannot be used as a staff directory, and it is rate limited per address and per source.

The evidence link in your email is a different, smaller credential

Each “View evidence” link carries a token minted for one named person and one finding. It opens that brief with no login step, and it is forwardable on purpose — a category manager sending evidence to their boss is the behavior you want, not a leak to design against.

What it deliberately cannot do: open a session, reach the register, or silence a finding. Marking something “known or expected” or “not actionable” suppresses it for ninety days, so those two answers step up to a verified sign-in. The reasoning is uncomfortable and worth stating: the party most motivated to mark a retailer problem “not actionable” is the retailer.

The portal is deliberately small

It runs no JavaScript at all and declares a content policy that permits none, so there is no third-party script, no analytics beacon and no injected dependency inside a page showing your commercial data. No link can change state: clicking a URL renders a form, and only submitting it — with a server-issued, single-use token — writes anything. That matters more than it sounds, because corporate mail scanners follow every link in every message before a human ever sees it.

Which organization you belong to comes from your credential, never from the address bar. A request for another client’s record is answered “does not exist” rather than “not permitted”, because the second phrasing confirms the record.

Anthropic — our analysis agent runs on Anthropic’s API, under commercial terms in which content sent to the API is not used to train models. What it sees is aggregated commercial data at the level of a product line in a retail channel, not customer-level or transaction-level records. And the model never does the arithmetic: every number in every alert is computed by a query against your data, with the query recorded alongside the finding.

Postmark — the delivery path for digests and sign-in links, sending from our own authenticated domain.

Google Cloud — the warehouse, the application database, and a private bucket holding a copy of each published brief.

Google Sheets — only if you want the Explorer workbook, which is created on our service identity in our own shared drive rather than on any individual’s account.

That is the whole list. It is short on purpose, and every addition to it is a decision rather than a default.

The action register keeps an audit trail rather than a current state: every publication, every response, every note, every outcome verdict, every dispute of a verdict and every value claim is recorded with who did it and when — including whether the actor was a person on your side, a person on ours, or the system.

• Who opened a brief, and when. Because the link is per person, this is a name rather than a hit count — and automated link scanners are labeled as such, so a mail filter is never reported to you as engagement.
• Every decision the publishing gate made, including the ones a human overruled. That disagreement rate is the number that governs whether the gate is ever allowed to publish on its own.
• Consumed one-time tokens are kept, not deleted — they are the evidence a response was submitted once rather than replayed.