Security & your data at PEAC

Version [1.0] · Effective [Effective date]

Your pipeline and your client relationships are the most commercially sensitive information your firm has. Here is, in plain English, how PEAC looks after them.

Your data is yours

• You own everything you put into PEAC. We claim no rights over it.
• We never sell it, never use it for advertising, and never upload your contacts to any advertising platform.
• PEAC has no AI features and we do not use your data to train AI models. Forecasts are calculated from the figures and probabilities you enter — nothing more.

Who can see it

• Only the people your firm invites. Each firm has its own private workspace. Every request is checked against the signed-in user's firm, so one firm can never see another's data.
• Your super-admins are in control. They invite and remove colleagues, reset passwords and decide who has super-admin rights. There are two access levels: Super-admin and User.
• We don't have a login to your workspace. PEAC Studio has no user account in any customer workspace and there is no "back door" admin screen. Technical access to the underlying systems is restricted to our director and used only to keep the service running, fix a fault you've reported, deal with a security incident, or where the law requires it.

How it's protected

• Encrypted connections. Everything between your browser and PEAC travels over HTTPS.
• Passwords are never stored. We keep only a one-way bcrypt hash; nobody, including us, can read your password.
• Private file storage. Attachments are kept in private cloud storage and opened only through short-lived secure links. Executable and script file types are blocked.
• No card details. Payments are handled entirely by Stripe; card numbers never touch PEAC.
• Backups. The database is backed up automatically [frequency and retention — confirm with our hosting provider].

Where it lives

PEAC is hosted on managed cloud infrastructure provided by our hosting provider, Abacus. Your data is stored in [Hosting region]. Where any provider processes data outside the UK, we use the legal safeguards required by UK data protection law. Our full list of sub-processors is in our Data Processing Agreement at peac.studio/dpa.

Leaving is easy

• Super-admins can export your firm's data at any time [export feature — to be built before launch].
• If you cancel, your workspace stays read-only for 30 days so you can export, then it is permanently deleted. Backups roll off within [Backup retention] days.

Data protection paperwork

• Our Data Processing Agreement (UK GDPR Article 28) is part of our Terms automatically — there is nothing to sign separately. It is available at peac.studio/dpa.
• PEAC Studio Ltd is registered with the ICO: ZC283174.
• Supplier or security questionnaire to complete? Email support@peac.studio and we'll get it back to you.

Reporting a security issue

If you think you've found a security vulnerability, please email support@peac.studio with "Security" in the subject. We'll acknowledge it within one working day.