AI and data
Your data and AI, in plain terms
Your data stays yours. It sits in systems set up for your firm alone, and it is never used to train an AI model. This page shows where it lives, who can see it, where AI is involved and how you leave.
Where your data lives, by what you buy
| What you buy | Where your data sits | Where AI comes in |
|---|---|---|
| Web dashboards and apps | A database set up for your firm alone. See the next section. | Used to build it. None inside it. |
| Excel trackers and models | Your workbook, on your systems. We keep a copy. | Used to build it. None inside it. |
| Automation and briefs | Your own systems, read by your firm's AI account, not ours. | Runs in your own AI account. |
| Advisory work | The files you send, in a private folder for your firm. | Drafts it. Figures cite sources. |
| Workshops | Nothing leaves your firm. We teach on made-up data. | Shown live, on made-up data. |
Inside a web tool: three services, one job each
| Service | Its job | Holds your records? |
|---|---|---|
| GitHub | Keeps the tool's code in a private repository. | No. Code only. |
| Vercel | Serves the tool's pages to your browser, encrypted. | No. Pages only. |
| Supabase | Runs the database and logins, on Amazon Web Services. | Yes. The one place they sit. |
- One firm, one project, in a North American data center region named in your Scope of Work.
- Encrypted in storage (AES-256) and in transit (TLS). Supabase and Vercel each hold a SOC 2 Type 2 report.
- Firm logins only. Only your firm's email addresses can sign up, and the database enforces each role.
- Backed up every day, with seven days kept. Your admins can also download a full copy at any time.
Who can see your data
- Your people, at the role your admins set, and Jackson Bates of DataBates, to build and support your tool.
- The providers named on this page, plus Google Drive and email (Apple iCloud Mail, Gmail) for the files and messages you send us.
- No one else. Your data, figures and names are never used for another client, in a demo or in marketing.
Where AI is involved, and where it is not
- Building. We use Claude, from Anthropic, to write code, load data and draft documents, so it reads the files you send us. Model training is off, and no other AI service touches your data without your written OK.
- Inside a tracker or dashboard. No AI. Risk flags and due dates come from fixed rules, not from a model.
- Agents and briefs. Optional. They run in your firm's own AI account. AI output is always a draft for your team to review.
Your part, and how you leave
- What to send. Only what the job needs: no Social Security numbers, bank details or tax returns unless the scope calls for them. Confirm any client consent your professional rules or tax law (Section 7216) require.
- Export any time. A full export of your data is yours on request, member or not.
- Never locked out. A partner at your firm holds a sealed admin login from the first day.
- A clean handoff. When a membership ends, we move the hosting, database and code to accounts you control, with the admin login, the Owner's Guide and a one-hour walkthrough.
- Deleted on request, and told fast. We delete our working files at the end of a project when you ask. If someone reaches your data in our care without permission, we tell you within three business days.
A plain-English summary. Your signed agreements control. DataBates LLC is not a CPA firm, and nothing we deliver is an audit, a review, tax preparation or legal advice. Questions: hello@databates.us