Your data goes in.
It does not come out.
Security reviews stall when the answer is vague. Here's the concrete version: where data lives, how access is constrained, and what never gets used for training.
Three promises I keep.
Private by default
Your workspace stays private unless you choose to share.
Never used for training
Your data never trains AI models. Not mine, not the providers I use.
You control sharing
Reports stay private until you publish. Published links are random and secret.
Questions you're probably asking.
I'd ask them too. Here are straight answers.
Can anyone at hey anna see my data?
Your account and files are protected with authentication and access controls. Your workspace is private by default.
What happens when I ask Anna a question?
Anna reads your data directly to give accurate answers — that’s how she catches patterns a summary would miss. Your conversation is private to your workspace, and your data is never used for AI training.
What if I share a report?
A shared link shows the report you chose to publish. It does not open your private workspace or source file.
Where does my data actually live?
Encrypted cloud storage, tied to your account. Anna accesses your data when you ask a question — the same way a human analyst would open your spreadsheet. Nothing is shared outside your workspace, and nothing is used for training.
What I'll never do.
Some things are off the table. Period. No exceptions, no asterisks.
Here's what actually happens.
When you upload a file or ask me a question, this is the journey.
Upload
Your file goes to encrypted cloud storage tied to your account.
Analyze
Anna sends column metadata, summary statistics, sample rows, and your messages to Anthropic for reasoning. The full file stays in R2 and your browser. Anthropic does not train on API inputs per their commercial terms.
Share (optional)
If you publish a report, it gets a random, secret link. You can unpublish anytime.
For your IT team.
The technical detail your security review needs.
Infrastructure
Edge compute
Application logic runs on Cloudflare Workers — distributed across 300+ data centers, no single origin server.
Data storage
Metadata in Cloudflare D1 (SQLite at edge). Files in Cloudflare R2 (S3-compatible object storage). All data encrypted at rest.
Analysis sandbox
Python runs client-side in a WebAssembly sandbox. Your data stays in the browser for computation.
AI processing
Questions are sent to the Anthropic Claude API for analysis. Anthropic does not train on API inputs per their commercial terms.
Compliance & legal
GDPR & breach notification
Affected users are notified within 72 hours of a confirmed breach, in line with GDPR Article 33 timelines. Our incident response policy is published.
DPA on request
We can sign a Data Processing Agreement covering Article 28 obligations and the sub-processor list below. Email support@heyanna.studio.
SOC 2 — open to it
We don't have a SOC 2 report today, and we're open to going for one as we grow into bigger customers. If your review depends on it, email support@heyanna.studio — we'll share the architecture detail security teams usually need and talk through your timeline.
No PHI / no HIPAA BAA
We do not process protected health information. Do not upload PHI; we cannot sign Business Associate Agreements.
Sub-processors
Third parties we use to run the product. Only Cloudflare (where your dataset is stored) and Anthropic (the model that reasons over it) ever see the contents of your dataset. Everything else handles account, billing, transactional email, or anonymous usage signals. Always-on processors apply to every account; the rest only engage when you opt in to the matching feature.
Always on
Workers (compute), D1 (metadata), R2 (file storage), Vectorize (memory embeddings), Workers AI (embedding model), AI Gateway (Anthropic proxy)
Claude language model for analysis. Commercial-terms customer; inputs not used for training.
Transactional email (account, billing, share notifications).
Product analytics and error tracking. We do not stream dataset contents.
Subscription billing and tax handling for paying customers (merchant of record).
Only when you connect or use it
OAuth sign-in, Google Sheets / Analytics imports — only when you connect a Google account.
MCP integrations broker (HubSpot, Notion, Airtable and others) — only when you connect an integration through it.
Public social-media data fetches (TikTok, Instagram, YouTube, X, Facebook, Threads) — only when you use the Public Social Data source.
Affiliate referral tracking — only when you sign up via an affiliate link.
Subscription metrics for paying customers; receives billing-event data, not dataset content.
Data residency, retention & deletion
Today, data routes through Cloudflare's global edge with primary storage on Cloudflare's network. R2 supports regional pinning if you need EU-only or jurisdiction-locked storage — email support@heyanna.studio before signing up and we'll provision your account into the right region.
| When you… | What happens |
|---|---|
| Delete a dataset | File removed from R2, metadata removed from D1, related embeddings purged from Vectorize. Immediate; no soft-delete window. |
| Unpublish a report | Public link invalidated immediately. R2 snapshot is removed on hard-delete. |
| Delete a memory | Removed from D1 and the corresponding Vectorize embedding is purged. Manageable per-memory in Settings. |
| Close your account | All datasets, memories, conversations, and reports are deleted. Backups follow the platform-native retention windows below. |
| Anthropic AI Gateway logs | Cached and observability logs retained 30 days for debugging, then expired by Cloudflare. |
We don't run separate cold backups beyond the platform-native retention windows Cloudflare provides for D1 and R2. There's no soft-delete or hidden archive of your data.
Authentication & Access Control
Published Reports
Questions about our security posture? support@heyanna.studio
For a full walkthrough of our architecture, read Where Your Data Actually Goes.
Last updated: 2026-05-26
Ready to see what's in your data?
Your data stays private.
We use cookies to improve your experience. Privacy policy