Data & security
You are being asked to show an outside firm how your business really runs, and, for a build, to let us near your systems. Here is exactly what we take, where it goes, who can see it, and how it ends.
What we collect, and when
- 01
The diagnostic works from evidence you give us, not access you grant us.
We interview your team, watch the job being done, and take the documents you already have — a procedure, a spreadsheet export, a screenshot of the system in use — plus a short questionnaire. We do not connect to your systems, install anything, or pull data ourselves. Everything we hold, someone on your team handed us knowingly.
- 02
Every finding traces back to its evidence.
Each observation in your Operational Map is labelled a fact, an inference, a hypothesis or an assumption, and links to the transcript, document or screenshot it came from. Numbers carry a unit, a period and a source. Nothing in the report is unsourced, and an estimate is never dressed up as a measurement.
- 03
For a build, access is agreed in writing first.
Before we touch anything you get a one-page list of exactly which systems, which accounts, what level of access, and why. You approve it. Nothing outside that list is used.
- 04
We work inside your accounts, not on copies of your data.
Build work happens in the tools you already run, under access you grant and can revoke at any time. We do not take extracts of customer or financial data off your systems to work on elsewhere.
- 05
Access ends when the work ends.
Every credential is removed at handover, and we confirm it in writing. Anything we built stays with you.
- 06
Your people keep the final say.
Anything that moves money, contacts a customer, or requires judgement stays with a person on your team. We build the work between those decisions, not over them.
Where what you give us is held
- 07
Files go into a private store with no public address.
PDFs, exports and screenshots are kept in a private object store (Cloudflare R2). No file has a public URL. Every read is a signed link that expires after five minutes, issued fresh each time to a signed-in Bridgr staff member. Files are stored under an opaque key, never under your filename.
- 08
Uploads are checked before they are stored.
Only PDF, plain text, CSV, Excel and PNG/JPEG/WebP are accepted, up to 20MB each. The server checks the file's actual content against its declared type, so a renamed executable is rejected rather than stored.
- 09
Your records belong to your organisation, and the database enforces it.
Transcripts, observations, measurements and the map itself live in a Postgres database (Neon). Every row carries the organisation it belongs to, and that boundary is enforced by the database, not only by the application. Storage and database traffic is encrypted in transit, and both providers encrypt at rest.
Who can see it
- 10
Named Bridgr staff only, by allowlist.
Sign-in is passwordless: a one-time code sent to an email address that has been explicitly granted access. There are no shared logins and no passwords to leak. There is no client portal yet, and nothing of yours is reachable from a link without signing in.
- 11
Revoking someone ends their access immediately, and it is logged.
When a staff member's access is revoked, their membership and every active session are removed in a single operation, and an audit entry records what was removed. Every grant and revocation is written to the audit log.
Where AI is used
- 12
A model may draft; only a person decides.
We use a language model to propose candidate observations from an interview transcript, and to draft wording for the map from observations that have already been accepted. Every AI proposal is stored as a proposal, labelled as AI-authored, and cannot enter your map until a Bridgr operator accepts it. The model has no path to accept its own output.
- 13
Only the text needed for the task is sent, and you can opt out.
Model calls go through OpenRouter to a Google Gemini model. We send the transcript text or accepted observations required for that call — no files, no credentials, no data beyond the text itself. The diagnostic is designed to work without this step: if you would rather we did the extraction by hand, say so and we will.
Deleting it
- 14
Evidence cannot be quietly removed from under a finding.
A document or excerpt that an observation cites is protected from deletion while the observation exists, including a rejected one. The record of why something was found, or dismissed, stays intact.
- 15
Ask, and we delete it and confirm in writing.
At the end of an engagement, or at any point on request, we delete your evidence files and records and confirm to you when it is done.
Before you ever talk to us
- 16
What we know about you is public.
Before a first conversation we work from public sources only: Companies House, your website and published reviews. We do not buy contact lists or scrape private data. If you ask us not to contact you, you go on a suppression list and we stop.
- 17
This website logs its own page views, and nothing more.
We record the page, the referrer, campaign tags, the country and a hashed session identifier, in our own database. No advertising pixels, no third-party analytics scripts.
Who else touches it
The services your data passes through. Nothing else does.
- Netlify
- Hosting and serverless runtime
- Neon
- Postgres database
- Cloudflare R2
- Private file storage
- Resend
- Transactional email (sign-in codes, notifications)
- OpenRouter → Google Gemini
- AI drafting, as described above
Anything here you want in a contract, or a question this page doesn't answer? Ask on the call →