Trust Center
One place for how CGE Insights handles your data and what it agrees to. Each document also has its own page, so you can link straight to it.
Security
How access to your data is controlled, in plain terms.
- No passwords to steal. Sign-in is Google or Microsoft single sign-on, or a link sent to your email. CGE Insights never stores a password.
- Sessions end on their own. Signing in expires after a period of inactivity, and again after a fixed maximum, so a forgotten open tab does not stay signed in indefinitely.
- Connected accounts are encrypted. Credentials for services you connect, and the addresses CGE sends webhooks to, are encrypted before they are stored.
- Data is encrypted in transit and at rest by the hosting and database providers listed under Sub-processors.
- You are told before the list changes. New sub-processors are published here with 30 days' notice.
Current security status. Member data is read server-side only, and the database refuses direct access from a browser. Connected provider credentials and webhook URLs are encrypted with Fernet. Sessions end on both idle time and an absolute limit, outbound webhooks are HMAC-signed, administrative actions are written to an audit log, and member names and email addresses are never sent to the AI model. CGE Insights carries technology errors and omissions insurance with a cyber endorsement. It does not currently hold SOC 2 or other formal security certifications. Additional monitoring and certification capabilities are part of the platform's continued development.
Questions, or reporting something that looks wrong: support@cgeinsights.com
Outside services that handle your data
These are the companies CGE Insights uses to run the service. This page is the public record of that list. A new service is added here before it handles any customer data.
Current as of 2026-09-21.
Required to run the service
The service cannot run without these.
| Service | What it does | What it handles |
|---|---|---|
| Supabase | Primary database | All Member and Customer data |
| Render | Backend hosting | Everything the API touches |
| Vercel | Frontend hosting + server-side proxy | Customer-user requests, session data, application responses |
| Stripe | Payments and billing | Billing contact and payment details |
| Resend | Transactional email | Recipient address and message content — magic links, notifications, form submissions |
Used only by certain features
Each of these supports one feature or one connection. If you would rather not use a service on this list, the feature that depends on it can be turned off for your account.
| Service | What it does | What it handles |
|---|---|---|
| Google Cloud (Gemini) | Strategy Advisor, Ask Cora | Behavioral signals and derived flags — no Member names or emails |
| Google SSO | Customer-user sign-in | Customer-user identity only — never Member data |
| Microsoft SSO | Customer-user sign-in | Customer-user identity only |
| Mailchimp / Mandrill | Email engagement in, outreach out | Member email and outreach content, when the Customer connects it |
| Novi AMS | Member roster sync | Roster fields synchronized both ways |
| HubSpot | Planned (added 2026-09-21). CRM activity in — email activity, meetings and calls as counts, four purchase summaries | Member email and the activity listed; no notes, tickets or tasks, and no free text — the scopes do not request them |
| Microsoft Dynamics 365 | Planned (added 2026-10-03). CRM roster and activity in, from the Customer's own Dynamics environment | Member contact fields and requested activity records. Which fields depends on that Customer's own Dynamics configuration |
| MemberClicks | Planned (added 2026-10-03). AMS roster sync | Roster fields synchronized between MemberClicks and CGE Insights |
| Wild Apricot | Planned (added 2026-10-03). AMS roster sync | Roster fields synchronized between Wild Apricot and CGE Insights |
| Zoom | Planned (added 2026-10-03). Event and webinar attendance in | Attendee email address and attendance records for the Customer's own events |
| Eventbrite | Planned (added 2026-10-03). Event registration and attendance in | Attendee email address and registration/attendance records for the Customer's own events |
| Cvent | Planned (added 2026-10-03). Event registration and attendance in | Attendee email address and registration/attendance records for the Customer's own events |
| Sentry | Application error monitoring | Error and diagnostic data |
Listed for openness
This one is part of how the service runs, but it never receives personal data. It is listed so nothing in the stack is unexplained.
| Service | What it does | Why it is not on the list above |
|---|---|---|
| cron-job.org | It triggers background work on a schedule | Receives no personal data — only authenticated requests telling the backend to run a job. Disclosed because an unexplained third party in the stack invites the question |
Places you send data yourself
If you set up a webhook, or connect Slack or Microsoft Teams, member data goes to a destination you chose. Those destinations are yours to manage, so they are not on this list.