Answers to the questions every enterprise procurement team asks before signing. No marketing claims — just what we actually built.
All customer data — workshop notes, requirements, templates, user accounts — is stored on Google Cloud Platform in the us-east1 (South Carolina, United States) region. This includes Cloud SQL (PostgreSQL) and Cloud Run compute. No data is replicated outside this region unless you request a custom data-processing arrangement.
Customers who need a different residency region or a written data-processing addendum can contact us — we provide a signed DPA with Standard Contractual Clauses (SCCs) and UK transfer terms on request. View our DPA.
We do not use your workshop data to train AI models — ever.
Exordia processes workshop notes through Google Vertex AI (Anthropic Claude and Google Gemini). That processing is transient: data is sent to the inference endpoint, the response is returned, and nothing is retained by the AI provider for training purposes. This is a contractual guarantee under Google's enterprise service agreements for Vertex AI.
Specifically: we use Vertex AI — not the consumer-facing Claude.ai or Gemini.google.com APIs — and Vertex AI's enterprise terms explicitly prohibit Google and Anthropic from using customer-submitted prompts or outputs to train or improve their foundation models.
Everything you create in Exordia belongs to your organization — full stop.
All workshop notes, requirements, templates, and client data you create in Exordia belong to your organization. We process and store it on your behalf — we never claim ownership, never aggregate it across customers for training, and we never sell or share it with third parties.
Your data is yours to export at any time via Settings → Privacy → Export Data. The export is a complete JSON archive of your organization's projects, workshops, requirements, and templates.
Q: What happens to my data if I cancel?
A: Your data is retained for 30 days after cancellation so you can export it via Settings → Privacy → Export Data. After 30 days it is permanently deleted from production and backup systems within 90 days. No data is carried forward, shared, or used for any purpose after deletion.
Every query in Exordia is scoped to a single organization. The Prisma ORM client is extended at the database layer to automatically inject deletedAt: null on soft-delete models, and every server action gates on the authenticated user's organizationId before touching the database. Cross-organization reads are structurally impossible, not just policy-prohibited.
An ESLint rule (exordia/require-deleted-at-null) enforces the soft-delete filter at author time; violations are a build error. A recent internal security audit closed all 9 open findings against the query layer.
What we have today.
deletion_protection_enabled = true — it cannot be destroyed without an explicit override.If you discover a security issue, report it to [email protected] (also listed in security.txt).
Third-party services that process customer data on our behalf.
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Infrastructure (Cloud Run), database (Cloud SQL PostgreSQL, us-east1), artifact storage | United States (us-east1) |
| Anthropic (via Google Vertex AI) | AI inference — workshop synthesis, requirement generation. Transient only; no retention. | United States |
| Google Gemini (via Google Vertex AI) | AI inference — alternate model path. Transient only; no retention. | United States |
| Google OAuth | Authentication identity provider | Global |
| Microsoft Entra ID | Authentication identity provider | Global |
| Stripe | Payment processing and subscription billing | United States |
| Postmark | Transactional email (invitations, notifications) | United States |
| Upstash Redis | Rate limiting and ephemeral session caching | United States |
AI sub-processors (Anthropic, Google Gemini) operate under Google Vertex AI enterprise service terms, which prohibit use of customer data for model training or improvement.
Exordia respects your rights under GDPR, CCPA, and other applicable privacy laws. You can:
Deletion and anonymization requests are fulfilled within 30 calendar days, subject to legal hold and platform-integrity requirements. See our Privacy Policy for the full policy, or our DPA for the contractual obligations around data processing.
For customers who need documentation to share with their security or legal team, we provide a Security Pack: architecture diagram, security controls self-assessment, sub-processor list, DPA, and responses to common vendor questionnaires.
For security disclosures, procurement questions, or DPA requests, reach us at: