Security & data processing

LOCATIONiQ is built multi-tenant from the ground up. Your portfolio, criteria, and reports are yours — isolated, encrypted, and never used to train AI models or shared with other customers.

How we protect your data

Tenant isolation	Every business record carries an orgId; queries are org-scoped at the data layer. One customer can never read another's sites, criteria, or reports.
Encryption in transit	All traffic is served over TLS (HTTPS) with valid certificates. The API and app reject plaintext.
Encryption at rest	The database (Neon Postgres) encrypts data at rest. Provider API keys you store are additionally sealed with AES-256-GCM before they touch the database.
Access control	Role-based permissions (Owner / Admin / Analyst / Viewer) plus superadmin-controlled per-org and per-user feature restrictions. Enforced in the UI and again on the server.
Authentication	Google OAuth and email magic-link via Auth.js. Sessions are signed JWTs. No passwords are stored.
Payment data	Card details are handled entirely by Stripe (PCI-DSS Level 1). LOCATIONiQ never sees or stores card numbers.
Auditability	Security-relevant actions (scoring, status changes, report generation, access-policy edits) are written to an immutable audit log.
Error monitoring	Runtime errors are captured (Sentry) without logging secrets, so issues are caught and fixed quickly.

Subprocessors

We use a short list of reputable providers to run the service:

Vercel	Application hosting (US)
Neon	PostgreSQL database (US-East)
Stripe	Payments & billing
Resend	Transactional email
Anthropic	AI narratives & assistant (no training on your data)
Google Cloud	OAuth sign-in
U.S. Census / BLS / FRED / OpenStreetMap	Public reference data for scoring

Data ownership & retention

You own your data. Export it any time (CSV, reports, or the API), and request deletion of your workspace.
AI providers process your prompts to generate output only — your data is not used to train models.
Deleting a site removes its analyses, comments, tasks, and reports.

Compliance & agreements

A Data Processing Agreement (DPA) is available for customers who need one — email security@locationiq.io. We are not yet SOC 2 certified; a formal program is on our roadmap as we grow. We're happy to complete security questionnaires for enterprise evaluations.

Found a vulnerability? Please report it responsibly to security@locationiq.io — we'll acknowledge within 3 business days.