Security and confidentiality
Security and data handling are defined before project material is shared.
You will be asked to share sensitive project material. This page describes, honestly, what is accessed, where it is processed, whether copies are kept, who can reach it, and how it is removed.
In plain language: your project materials are used to deliver your engagement and nothing else. They are not used to train the AI models and they are not sold. They are encrypted in transit, stored in access-controlled, tenant-isolated cloud storage, and removed after the engagement.
- What material is accessed
- Only the materials you agree to share for one project: documents such as the SOW and requirements, plans and schedules, status reports, meeting notes, decisions, risk logs, change documentation, and relevant spreadsheets or exports. We define the exact set together before anything is shared. PMAC reads project management evidence; it does not access engineering designs, drawings, or CAD.
- How it is shared with me
- Files are transferred over an encrypted connection (TLS/HTTPS) and uploaded into private, access-controlled cloud storage. Nothing is shared before the scope, the management questions, and the data-handling terms are agreed.
- Where it is processed
- Analysis runs on Anthropic’s Claude models, accessed through Anthropic’s API. Project data is stored on managed cloud infrastructure (Supabase and Vercel). Operational monitoring uses a limited-visibility observability layer that receives only truncated prompt and output fragments, never the full body of your project material.
- Whether copies are retained
- Yes. To analyze the project, your materials are stored as copies in private cloud storage for the duration of the engagement. They are kept in a tenant-isolated store protected by row-level security, and are removed after the engagement on a schedule we agree. Account-level data handling is described in the Privacy Policy.
- Who can access it
- Access is controlled and limited. Data is isolated per client using row-level security in the database and in file storage, so one engagement's materials are not reachable from another. Guy Kushnir personally leads the work; access is limited to what is needed to deliver the analysis.
- Whether the model providers train on your data
- No. Your project materials are not used to train the AI models behind PMAC, and your data is not sold. The analysis is performed to deliver the engagement to you, not to improve a product for other customers.
- Confidentiality terms
- Confidentiality and data-handling terms are defined in the engagement agreement before any material is shared. If your organization requires a specific NDA or data-processing agreement, we handle that up front.
- Options for regulated or sensitive environments
- For regulated organizations that require a different deployment and security model, a private or locally-controlled delivery option is available, scoped to your constraints. Some answers on this page depend on that specific setup; where they do, we say so plainly and agree the details with you. See the pricing page or contact Guy directly.
- How data is removed after an engagement
- When an engagement ends, your project materials are removed on the schedule agreed in the engagement. You can also request removal earlier. The full account-level retention and deletion terms are in the Privacy Policy.
What we do not claim
Precise, not inflated.
- We do not hold formal security certifications (such as SOC 2 or ISO 27001) today. We describe the controls that are actually in place rather than claim ones we do not hold.
- Encryption at rest is provided by the managed cloud platform (Supabase and Vercel), not a custom encryption scheme of our own.
- Where an answer depends on your specific setup - for example a private or locally-controlled deployment - we say so and agree the details with you rather than state a single answer for everyone.
For security, confidentiality, or data-handling questions specific to your engagement, contact guy@pmagentchain.com. The full data-processing terms are in the Privacy Policy.