Chattermill Analytics Limited

United Kingdom

The time period for which Chattermill retains customer data depends on the purpose for which it is used. Chattermill retains customer data for as long as an account is active or in accordance with the agreement(s) between Chattermill and the customer, unless Chattermill is required by law to dispose of it earlier or keep it longer.

Chattermill disposes of customer data within 30 days of a request by a current or former customer or in accordance with the Customer’s agreement(s) with Chattermill. Chattermill may retain and use data necessary for the contract such as proof of contract in order to comply with its legal obligations, resolve disputes, and enforce agreements. Chattermill hosting and service providers are responsible for ensuring the removal of data from disks allocated to Chattermill use before they are repurposed and the destruction of decommissioned hardware. Only a limited number of Chattermill employees can delete customer data. Such list Senior Management and Engineering organizations. Upon employee or contractor termination, company-owned devices will be collected and sanitized prior to device reissuance in accordance withNist Guidelines for Media Sanitization (NIST S.P. 800-88 Rev. 1).

Chattermill Data Storage PolicyPurpose and ScopeThis Data Storage Policy establishes the requirements and controls for the secure, appropriate, and compliant storage of all data assets at Chattermill. It defines where data may be stored, what security controls must be applied, and the responsibilities of personnel in handling stored data. This policy is intended to complement the Data Classification Policy, the Data Retention and Disposal Policy, and the Encryption and Key Management Policy.From time to time, Chattermill may update this policy and implement different levels of security controls for different information assets, based on risk and other considerations. This policy is guided by security requirements specific to Chattermill including applicable laws and regulations, including the UK Data Protection Act 2018 and GDPR.This policy applies to all Chattermill data assets stored by or on behalf of Chattermill, and to all personnel acting on behalf of Chattermill, including employees, contractors, and third-party service providers. All personnel are required to read, accept, and follow all Chattermill policies and plans.Approved Storage LocationsAll Chattermill data must be stored only in approved systems and locations. The appropriate storage location is determined by the data classification as defined in the Data Classification Policy. Storing data outside of approved systems requires prior written approval from the relevant data owner and security team.Public and Internal DataPublic and internal data may be stored in any Chattermill-approved productivity and collaboration platform, such as Google Workspace (Drive, Docs, Sheets, Slides), Notion, or equivalent company-approved tools. Personnel must still apply appropriate access controls to prevent unintended external exposure of internal data.Confidential DataConfidential data must be stored only in Chattermill-approved systems with access controls that restrict access to authorized personnel on a need-to-know basis. Approved storage platforms for confidential data include: Google Workspace (Drive) — with sharing permissions set to internal Chattermill users only Chattermill production databases and data infrastructure, managed by the Engineering team Approved SaaS platforms with a signed Data Processing Agreement (DPA) in place Encrypted local storage on Chattermill-managed devices where temporary local storage is operationally required Restricted DataRestricted data must only be stored in purpose-built, highly secure systems with the strictest access controls. Examples include: Secrets management tools (e.g., AWS Secrets Manager, Google Secret Manager, HashiCorp Vault) for credentials, private keys, and API tokens Chattermill's source code repositories (e.g., GitHub) — access to the codebase is restricted to authorized Engineering personnel only Dedicated secure data stores for financial, legal, or HR records, accessible only to authorized members of the relevant function Encrypted, access-controlled databases where regulatory or contractual obligations require it Restricted data must never be stored in personal email accounts, personal cloud drives, personal devices, or any system not explicitly approved by Chattermill management.

Netherlands, United States

Cloud hosted, GCP.

Google Cloud Platform

no

no

yes

2025-02-25

yes

SAML, ADFS, Google and others

yes

yes

security@chattermill.com

yes

yes

no

no

Auth0, Intercom, Rollbar

no