Built in Europe. Designed for trust.
Sales data is sensitive. It contains customer conversations, deal economics, and strategic intent. We treat it accordingly, as a commitment we made when we started building.
Everything below reflects how superglass works today, not a roadmap. If your security team has questions not answered here, contact us directly.
EU-hosted infrastructure
superglass was built in the European Union and runs entirely on European servers. Your data never leaves the EU - not for processing, not for storage, not for AI inference.
- All infrastructure hosted in EU data centers
- No data transferred to US or third-country servers
- Enterprise-grade encryption in transit and at rest
GDPR & EU AI Act compliance
We designed for compliance from day one, not as an afterthought. Our data handling practices are aligned with GDPR and the EU AI Act - the two most rigorous data protection frameworks in the world.
- Full GDPR compliance - lawful basis, data minimization, retention limits
- EU AI Act aligned - no automated sole decision-making; a human always reviews before anything is applied
- Right to access, rectification, erasure, and portability honored on request
Data isolation per workspace
Every customer workspace is fully isolated. Your methodology configuration, your CRM data, your Field Notes - none of it is shared across tenants or accessible to other customers.
- No cross-tenant data access under any circumstances
- Workspace data deleted within 30 days of account closure
Your data never trains AI models
This is a hard line. Your sales data, your methodology, your client conversations - none of it is used to train public AI models, fine-tune foundation models, or improve any system outside your workspace.
- AI processing uses enterprise API boundaries with no training data retention
- Your methodology configuration is never shared or benchmarked externally
- Raw Field Notes and audio are purged as soon as they're processed - never stored long-term
Human approval before CRM writes
superglass never writes to your Salesforce org without a human in the loop. Field Notes structures and classifies data first - the rep reviews, edits, and approves before anything is pushed.
- No automated CRM writes - every sync requires explicit rep approval
- Draft data visible only to the rep until committed
- Full audit trail of what was changed and when
Salesforce OAuth - read-only by default
The Salesforce connection uses OAuth 2.0. We read live CRM data to surface context - we do not store a copy of your Salesforce records, and write permissions are scoped only to what Field Notes needs.
- OAuth 2.0 - no passwords stored, tokens scoped and revocable
- CRM records read live, never cached or duplicated in our database
- Write scope limited to fields explicitly mapped in your methodology
Questions for your security team?
We are happy to complete security questionnaires, provide additional documentation, or arrange a technical call with your IT or legal team. We would rather answer every question up front than have security be a reason a good deal stalls.