Security & trust
Built to withstand scrutiny.
Executive intelligence only works if it can be trusted completely, which is why trust here is structural rather than asserted. This is exactly how we handle security, data and accountability, in the detail a procurement review actually asks for.
Data residency
Handled inside the EU
Agreements
DPA signed on request
Platform access
Signed, expiring sessions
- 12 month partnership
- Invoiced monthly
- No discounts
The four pillars
What we are accountable for, stated in full.
Four areas carry the whole answer: how the intelligence is evidenced, how the data is handled, how access is controlled, and what the commercial relationship actually commits you to.
Evidence-based and traceable
- Every finding in your deliverables is grounded in evidence, never in guesswork.
- Conclusions are traceable to the underlying data they rest on.
- Confidence is stated openly, and weak evidence is reported as weak.
- If an area yields nothing of substance, we say so plainly.
Data and GDPR
- Data is handled inside the EU.
- A data processing agreement (DPA) is signed on request.
- Deletion and data portability on request.
- Encrypted transfer over TLS and HTTPS. You keep control of your data.
Access and accountability
- The Executive Intelligence Platform is protected by signed, expiring sessions.
- Role-based access: your intelligence is visible to your account alone.
- Administration is separated from customer access at every level.
- Rate limiting on sign-in and on forms protects accounts from abuse.
Commercial confidence
- Three plans, invoiced in EUR. 12 month partnership, invoiced monthly.
- The listed amount is what you are invoiced each month. Any VAT that applies in your country is handled on the invoice.
- The term is a 12 month partnership because the intelligence compounds as it learns the business.
- Transparent pricing. No discounts, no promotional pricing, no hidden fees.
Technical web security
Hardened at infrastructure level, and verifiable.
Security should be something you can check rather than something we claim. Every point here is active in production, and the header protections can be verified directly in the response headers of this page.
Eight protections, all live. Open the response headers of this page in your browser and read them back against this list.
- HSTS with preload, forcing HTTPS for two years, including every subdomain.
- All traffic encrypted over TLS and HTTPS.
- Clickjacking protection: the site cannot be embedded in an iframe (X-Frame-Options: DENY).
- MIME sniffing blocked (X-Content-Type-Options: nosniff).
- Strict referrer policy, so internal paths never leak to third parties.
- Cross-origin window isolation (Cross-Origin-Opener-Policy: same-origin-allow-popups).
- Restricted Permissions-Policy: camera, microphone, geolocation, payment and USB are switched off.
- Payments are handled by Stripe (PCI-DSS Level 1). We never receive or store card details.
What we do not claim
We do not display certifications we do not hold, customers we have not been given permission to name, or figures we cannot evidence.
That is a deliberate choice. A partner whose entire promise is “decisions on evidence, not guesswork” cannot then guess about its own credibility. Everything shown on this page is true today, and when we reach a certification or are cleared to name a customer, it will appear here, verifiable.
Last updated July 2026.
Sub-processors
Every processor that touches your data.
PineappleAI uses the following sub-processors for the processing of personal data. We choose established, enterprise-reviewed providers and make sure the data handling complies with GDPR.
- Vercel
Hosting and edge delivery of the web application
DPA available from Vercel (vercel.com/legal/dpa).
- Supabase
Database (PostgreSQL) and authentication
DPA available from Supabase (supabase.com/legal/dpa).
- Stripe
Payment processing
DPA available from Stripe (stripe.com/legal/dpa).
- Google Workspace and Gmail
Transactional email
DPA available from Google (workspace.google.com/terms/dpa).
From procurement
The questions a reviewer actually asks.
Short, straight answers. If you need more, whether that is a DPA, the technical detail or a walkthrough with your security team, get in touch.
Where is our data stored?
Inside the EU. We sign a data processing agreement (DPA) on request and delete data whenever you ask us to.
Who can see our data in the platform?
Your account, and the PineappleAI team producing your intelligence. Access to the Executive Intelligence Platform is protected by signed, expiring sessions, and role-based access keeps every customer's data separated.
Do you promise a specific ROI or saving?
No. We report conservatively, validate against the underlying data and say so plainly when we find nothing. Credibility before promises.
What are we committing to, and what happens at the end of the term?
Each plan is a 12 month partnership, invoiced monthly. The term exists because the intelligence layer gets sharper the longer it reads your business. After the initial term the partnership continues monthly until either side ends it, and what it commits both sides to is written down in our terms.
How do we get started, and how long does it take?
Choose a plan, create your account and complete a short onboarding. Your first full intelligence cycle is completed within the first month. When the first findings land depends on the business, and we say so honestly rather than promising a date we cannot hold.
Do you guarantee uptime (SLA)?
We run on enterprise cloud infrastructure with publicly published operational status. We do not promise uptime percentages we cannot control, but during an incident we communicate directly with the customers affected and work actively with our providers to resolve it.
Ready when you are
Stop paying for the leaks nobody has looked for.
Choose a plan and your first intelligence cycle begins. If you would rather talk it through first, we will answer plainly and tell you if PineappleAI is not the right fit.