Security & Trust
Make a decision based on specific controls and operating requirements. This page describes the implemented service and the commitments that are agreed separately with each customer.
Workspace roles and scoped API keys
Source snapshots and review history
Credential handling and delivery controls
Implemented controls
The production-equivalent release suite validates role enforcement, workspace isolation, signed delivery, MCP authorization and billing reconciliation before publication.
The marketing website is public. Customer workspaces require WorkOS sign-in, and server-side membership checks restrict each workspace to its authorised members.
Agree any customer-specific enterprise sign-in, domain or provisioning requirements during onboarding.
Owner, admin, analyst and viewer checks restrict records and administrative operations.
Confirm user provisioning, offboarding and the permission model for your team.
API keys have scopes, expiry and revocation. Stored API keys are hashed, and generated secrets are shown once.
Confirm permitted data use, minimum scopes and rotation responsibilities.
Provider credentials are encrypted when stored, using deployment configuration kept outside the source repository.
Confirm credential ownership, approved providers and permitted datasets.
Source snapshots, investigation references, prior decisions and an exportable workspace activity log support traceable review.
Agree retention, export and deletion requirements for your records.
Outbound webhooks use signatures, bounded retries and delivery tracking. Duplicate source events are rejected by workspace-scoped identifiers.
Confirm approved destinations, receiver validation and downstream replay handling.
Hosting and data handling
The site is published through OpenAI Sites using a Cloudflare Worker and D1 storage. Company lists, review records and enquiries are stored by the application. Configured registry and AI connections can send relevant requests and records to their respective providers.
Do not assume a particular data-residency region, backup commitment or AI-provider policy from the hosting platform alone. Request the applicable contractual documentation for your intended use.
Procurement
Ask for the applicable access model, hosting arrangements, provider list and incident contact.
Agree the responsible entities, purpose, retention, deletion, data transfers and any required processing agreement.
Confirm collection frequency, availability commitments, support and recovery requirements. Global Data Intelligence Limited maintains ISO 27001 certification; scope evidence and contractual service commitments are provided during procurement.
Your questions
CompanyDelta is operated within Global Data Intelligence Limited's ISO 27001-certified information security management framework. Request the certificate, scope and Statement of Applicability during procurement.
The application restricts key administration to workspace owners and admins. A newly generated secret is shown once; the saved API-key record uses a hash.
The enquiry form stores the request, sends a service confirmation and does not automatically subscribe the sender to marketing.
Agree your data-processing and security requirements first. Initial enquiries should describe requirements without uploading confidential company lists or personal identity documents.
Start with your company list
Discuss your countries, company volumes and the questions your team needs to answer.