Signals aggregates your customer activity from Stripe, Gmail, Calendar, and CRM. We designed our architecture around a single principle: a database breach should never reveal who your customers are.
Customer emails, names, and company info are encrypted with per-tenant keys using AES-256-GCM. A database breach reveals encrypted blobs, not people.
Event payloads store activity metadata only. Email addresses and names are stripped at ingestion. Activity data is separated from identity.
Each tenant's data is encrypted with a unique key. Compromising one tenant's key has zero impact on any other tenant.
Your data is encrypted at every layer — in transit, at the application level, and at rest on disk.
All customer PII — emails, names, company names — is encrypted with AES-256-GCM at the application layer before it reaches the database. Each tenant has a dedicated encryption key, derived from a master key that never touches the database.
OAuth tokens for connected integrations (Stripe, Gmail, Calendar, CRM) are encrypted with the same per-tenant keys. Even with full database access, an attacker cannot read tokens or impersonate integrations.
Underneath the application-layer encryption, AWS RDS provides AES-256 disk encryption for all stored data.
We only store what we need. Email body content is never stored. Calendar descriptions and attachments are never stored. Event payloads contain activity metadata (amounts, dates, statuses) but no personal identifiers.
| Data | What we store | What we don't store |
|---|---|---|
| Subject, timestamp, recipient count | Body content, attachments, CC addresses | |
| Calendar | Event title, time, attendee count | Descriptions, attachments, attendee emails |
| Payments | Amount, date, status, billing cycle | Card details, bank info |
| CRM | Deal stage, amount, dates | Free-text notes with PII (stripped) |
Every database query is scoped to a tenant ID. There is no code path that can access another tenant's data. Authentication is enforced at the middleware layer, and tenant context is embedded in every session token.
All sensitive operations are logged with an immutable audit trail: customer deletions, data exports, blocklist changes, integration connections and disconnections, and account setting changes.
Audit logs never contain PII. They reference entities by ID, not by email or name. The audit trail is retained for the lifetime of your account, plus 90 days after account deletion for compliance.
Customer deletion is a hard delete — no soft-delete retention period. When you delete a customer, all their events, facts, and records are permanently removed in a single atomic transaction. The customer's email is added to a blocklist to prevent re-ingestion from connected integrations.
Account deletion has a 7-day grace period. During this window you can cancel. After 7 days, all data — customers, events, integrations, credentials, and configuration — is permanently deleted.
Export any customer's complete data in machine-readable JSON format — their profile, events, computed metrics, and group membership. This supports your obligations under GDPR Article 15 (Right of Access) and Article 20 (Right to Data Portability).
Customer data and events are retained for the lifetime of your account. We don't impose arbitrary retention limits on your core data. Operational data (expired tokens, orphaned credentials) is automatically cleaned up.
Signals runs on AWS with encryption and isolation at every layer.
These are the third-party services that process data on our behalf.
| Service | Purpose | Data processed |
|---|---|---|
| AWS RDS | Database hosting | All stored data (encrypted) |
| AWS ECS | Application hosting | Data in transit |
| AWS Secrets Manager | Key management | Encryption keys |
| Google APIs | Gmail & Calendar sync | OAuth tokens, email/calendar metadata |
| Stripe API | Payment sync | Webhook event data |
| HubSpot API | CRM sync | Contact and deal data |
| OnepageCRM API | CRM sync | Contact and deal data |
Signals acts as a data processor on behalf of our customers (data controllers). We support GDPR data subject rights including the right to erasure, access, rectification, and data portability. A Data Processing Agreement is available on request.
We're happy to discuss our security practices, provide our DPA, or answer questions from your security team.
Contact usLast updated April 2026