This is the current technical disclosure for ExecSignal's report, company-analysis, strategy, and valuation workflows. It names each commercial service that can receive customer-provided information, business-profile data, payment details, communications, or application telemetry, plus the boundary that keeps one service from becoming a general data destination.
No internal review is recorded for the exact current provider-disclosure contract.
Premium work can be scoped without uploading private documents.Application uploads pass through Vercel into a private Supabase bucket. Automated email uses links instead of attachments, OpenAI can receive only a selected reviewed OCR file, and an activated GitHub backup contains only an encrypted archive.
Customer workstreams use signed, expiring access tokens. Report and document buckets are not public, and admin writes require authenticated same-origin requests.
Controlled synthesis receives one section and allowed claims. Public-site analysis receives public captures. Only the valuation OCR path can receive a selected customer document.
Status describes this deployed release without exposing credentials. “Not enabled” means the optional pathway does not run; it does not remove the provider from this disclosure.
Official public-data publishers receive only generic industry, geography, and date-range queries. Those research sources and their usage limits are governed in Methodologyand each report's source register; they never receive customer files, contact details, intake answers, report content, or private links.
| Provider and status | Purpose and data sent | Document boundary | Retention and control | Provider policy |
|---|---|---|---|---|
| VercelApplication platform | Application hosting, server execution, delivery, and privacy-aware traffic analyticsHTTPS requests, submitted form and intake data while server code processes it, deployment logs, and consent-permitted page-view events. | Encrypted application transit; no file storage | Application records are stored in Supabase rather than Vercel-managed application storage. Platform logs remain subject to Vercel account settings and terms.Production is served over HTTPS. Uploaded files pass through the application runtime before private Supabase storage; ExecSignal does not place them in Vercel Blob or intentionally log request bodies or file bytes. | Vercel security and compliance |
| SupabasePrivate data and storage configured | Private database and object storageOrders, intake, report versions, QA records, support records, operational evidence, uploaded documents, and generated report artifacts. | Private storage provider | Order-linked intake, reports, uploads, and artifacts are retained for up to 24 months unless deletion is requested or a stated exception applies.Document and report buckets are private. File bytes are downloaded only by server-side service-role workflows; public browser clients never receive the service-role key. | Supabase shared responsibility model Supabase security |
| GitHub and GitHub ActionsSource and workflow provider; encrypted backup activation tracked separately | Private source control, deployment workflows, and optional encrypted off-site backup retentionApplication source and workflow metadata. When production backups are activated, an encrypted database and private-storage archive is uploaded as a workflow artifact; GitHub Actions secrets also supply the backup job with bounded production credentials. | Private storage provider | The workflow retains only the encrypted backup artifact for 30 days. Source history, workflow logs, and run metadata remain subject to repository and GitHub account settings.The backup is encrypted with AES-256 before artifact upload, the passphrase is stored separately as a GitHub secret, plaintext exists only on the ephemeral runner, and the repository workflow has read-only contents permission. Backup activation remains a separate provider-verified release gate. | GitHub privacy GitHub Actions secure use |
| StripeCheckout configured | Hosted checkout and payment event reconciliationCheckout email and payment details collected by Stripe, product and industry identifiers, legal-version identifiers, and bounded campaign attribution. | Never receives customer documents | ExecSignal retains Stripe customer, checkout, payment, and event identifiers needed for fulfillment, reconciliation, tax, fraud, and support records.ExecSignal does not receive or store full card numbers and does not send intake answers, report content, or uploaded documents to Stripe. | Stripe privacy Stripe security |
| ResendTransactional delivery configured | Transactional intake, delivery, support, and service emailRecipient email, message subject and body, report or order identifiers, and private access links needed for the requested service. | Never receives customer documents | ExecSignal retains provider message IDs and delivery events for fulfillment and troubleshooting. Reports are delivered through private links rather than document attachments.Uploaded documents and report payloads are not attached to provider messages. A private link can be revoked independently of the email. | Resend privacy Resend security |
| Google WorkspaceBusiness mailbox routing configured | Business email inboxes for owner-facing customer communicationCopies of sales, support, refund, security, and operational messages sent to role inboxes; sender and recipient metadata; message subjects and bodies; and private links needed for staff follow-up. | Only if a customer directly emails an attachment | Mailbox copies remain subject to the Workspace account's retention and administrator settings. The application separately retains bounded support, interest, provider-message, and delivery records under ExecSignal's retention policy.Automated report delivery uses private links and does not attach reports or uploaded documents. A customer can still choose to email an attachment directly; those files are not automatically imported into the workstream and should instead use the signed private upload path. | Google Cloud data processing terms Google Workspace security |
| OpenAI APIEnabled for valuation OCR, rendered-site analysis | Optional controlled synthesis, rendered-site analysis, and valuation OCRFor synthesis: a limited business profile, one current section, and allowed source-linked claims. For rendered-site analysis: public website captures. For OCR only: the selected private source document and a verification transcript. | Only for reviewed valuation OCR | ExecSignal retains validated structured output, provider response IDs, usage metadata, OCR transcripts, and review evidence in the private workstream. It does not persist a second copy of rendered-site captures.Every request sets store:false. OpenAI states that API inputs and outputs are not used for training by default; standard abuse-monitoring retention may still apply for up to 30 days unless separately approved data controls are verified. ExecSignal does not claim Zero Data Retention. Production OCR fails closed unless this exact disclosure has current approval and remains human-reviewed before reliance. | OpenAI business data privacy OpenAI API data controls |
| BrowserlessPublic-site rendering configured | Optional rendered desktop and mobile capture of public business websitesA bounded set of public website URLs and viewport instructions. | Never receives customer documents | Capture bytes remain in memory for analysis. ExecSignal retains the public URL, viewport, byte count, content hash, and structured observations, not the screenshot itself.The integration is limited to public-business website inspection. Browserless never receives customer intake, financial documents, report content, or private links. | Browserless privacy Browserless trust center |
| Google Maps PlatformNot enabled | Optional public competitor and traffic-unaware route contextResolved market geography, controlled industry searches, and public business coordinates. | Never receives customer documents | Bounded public place observations can enter source evidence. Routes content is used during generation and is not placed in the persistent source cache.Customer-uploaded documents, private intake notes, and report content are not sent to Google Maps. | Google privacy Google Maps additional terms |
| SerpApiNot enabled | Optional point-in-time public search-result observationsA controlled industry phrase and resolved city/state market. | Never receives customer documents | Compact public ranking, domain, listing-name, rating, and count fields are retained for up to 30 days rather than raw result pages.The request excludes the customer business name, street address, intake notes, financial data, uploaded documents, and report content. | SerpApi legal and privacy SerpApi security |
| SentryNot enabled | Optional independent technical error monitoringScrubbed exception details, release identifiers, route names, and bounded performance telemetry. | Never receives customer documents | Technical failure evidence remains subject to the configured Sentry retention policy.The integration removes customer identities, request bodies, cookies, private-link queries, uploaded documents, report content, and AI inputs or outputs. | Sentry security Sentry privacy |
The industry report does not require financial documents. A valuation workstream can request them only after purchase and signed customer access.
The customer opens a signed, expiring private workstream.
The upload is stored in a private Supabase object bucket.
Server-side parsers inspect the file first; browser clients never receive storage credentials.
If a supported file has no reliable text layer, OpenAI OCR is configured, and this exact disclosure has current approval, that selected file and its verification transcript are submitted with store:false.
The OCR discrepancy check and a human transcript decision must pass before valuation analysis can rely on the document.
The final report remains in private storage and is delivered through a revocable link.
store:false, but standard abuse-monitoring retention may still apply unless separately verified controls are in force.