Security, in plain words

Your own server

• Every customer runs on a dedicated server in the United States, with its own database and its own web address.
• No other customer's data or code runs on your server.

Your database stays yours

• UnpackData queries your database live when someone opens a report. There are no nightly copies to a shared system.
• Data you upload or sync, such as Excel files, is stored on your own server.
• We recommend connecting reports with a read-only database login, and forms with a login that can only write to the tables they need.

HTTPS

• Every workspace is served only over HTTPS.

Accounts and access

• Sign-up is by invitation only, with a confirmed email address, and invite links expire.
• Passwords are never stored in readable form.
• Sign-in has an “I’m not a robot” check to stop automated attempts.
• Roles decide which menus, reports and forms each person can see.

API keys and AI agents

• API keys are shown once, never stored in readable form, and can be given an expiry date or revoked at any time.
• The API limits how often it can be used.
• Claude connects with the same API keys, so you decide who can use it.

The AI assistant

• The assistant runs from your own server and uses a third-party AI service.
• It sends the AI service your question and how your tables are set up, but never the data in them or your results.
• You can check how it got each answer before you save anything.
• The AI provider states that, by default, it does not train its models on data sent to it.

The AI provider's data policy

Payments

• Card payments are handled by Stripe. Card numbers never reach our servers.