Trust

Trust & Data Protection

Last updated: 29 October 2026

SightPulse runs inside your own Azure tenant. This page explains where your data lives, who can access it, how we protect it, and which documents govern it. It is written for security, data protection and procurement teams.

1. Who does what

2. Where your data lives

• SightPulse deploys into a managed resource group in your Azure subscription, in the region you choose at deployment.
• The platform connects to your data where it already is, for example your data lake, lakehouse or warehouse. By default nothing is copied to systems run by SightPulse AG or CBS Systems.
• Data leaves your tenant only where your private offer or order selects it or you instruct us in writing, for a defined purpose. It is then processed in a dedicated EU Processing Environment: virtual servers in Germany operated for you by CBS Systems, administered by named personnel with multi-factor authentication and deleted when the project ends. This set-up takes additional set-up, operation and lead time, which we quote in your private offer or order.
• Data from your datasets is not stored in Serbia, wherever it is processed. Our engineers in Belgrade work on it by remote access only.
• Outputs (decision briefs, PowerPoint and Excel files, audiences, target lists and result tables) go only to the systems you connect and authorise, such as your Microsoft 365 mailboxes, CRM, CDP, field-force apps or lakehouse, using connections you control.
• Deleting the managed application deletes the platform resources in your subscription. Your source systems are not affected.
• Paid deployments process your data only after we activate them under your accepted private offer. The Demo plan runs on synthetic data only.

3. Who can access it

In both modes access requires multi-factor authentication and is restricted to named and trained personnel, and control-plane operations are recorded in your Azure Activity Log. We never have access to resources outside the SightPulse managed resource group unless you grant it explicitly.

Pseudonymised by default. Personal data in your datasets is processed in pseudonymised form by default, wherever the use case allows. Our engineers view direct identifiers, such as names or email addresses, only where needed to debug, provide support or resolve an incident, limited to the data and time that task requires.

4. How we protect it

CBS Systems d.o.o., which builds and operates SightPulse, is certified by TÜV NORD CERT GmbH:

Scope of both certificates: “Design, integration and maintenance of software solutions for data mining, business analysis and AI agents in the field of IT technologies”. The ISO/IEC 27001 certificate refers to the Statement of Applicability, edition A.1 of 26 April 2026, available to customers on request under confidentiality. The certificates cover the management systems of CBS Systems d.o.o.; SightPulse AG relies on them through its subcontracting and data processing agreement with CBS.

The measures below are commitments in our signed policies and in Annex 2 of our Data Processing Agreement.

• Least privilege: named, trained personnel; multi-factor authentication; access logged and reviewed at defined intervals.
• Segregation: each customer’s data is kept separate and used only for that customer.
• Encryption of data in transit and at rest, with controlled management of keys and secrets.
• Data minimisation: personal data only where your order puts it in scope and a use case needs it; pseudonymised by default where the use case allows.
• Secure development: security requirements, peer code review, separate development, test and production environments, and no customer production data in development or test without your approval. Automated dependency and vulnerability scanning and an external penetration test are being introduced in Q1 2027.
• Monitoring and incident response: security events logged and monitored; incidents investigated and documented; personal data breaches notified to you without undue delay and within 48 hours.
• Resilience: backup, business continuity and disaster recovery arrangements defined, maintained and tested.
• People: background checks as permitted by law, confidentiality undertakings, regular security awareness training.
• Suppliers: assessed before engagement and bound by confidentiality, security and data protection obligations.
• Return and deletion of customer data at the end of a contract, with written confirmation on request.

5. How we use AI

• Statistical and machine-learning models perform the analysis. Language models interpret your question, choose the procedure and explain the result. They never produce the numbers. To do this they receive the data a task needs, such as analysis results or customer-level sales, pseudonymised where the use case allows.
• Every number traces back to its source: the model, the version, the data and the weight of each driver.
• Inferred values are flagged as inferred, and results say so when data is insufficient.
• Every AI agent is evaluated against a defined test set before release, and its accuracy is reported to you.
• You choose the language model endpoint in your private offer or order: one your security team has approved, for example Azure OpenAI or Azure AI Foundry in your own subscription, or a model service we provide. If you use your own endpoint or connect other AI services such as Fabric data agents or Databricks Genie, your agreement with that provider governs where the data is processed. If we provide it, the provider is named in your order and acts as our sub-processor, with no training on your data.
• We use licensed panel and syndicated data only within the terms of your licence with the data provider.

6. Data protection and transfers

• When it applies. The DPA applies to all personal data we process for you. Every deployment processes the account and activity data of your authorised users. Personal data in your datasets, such as CRM, loyalty, CDP or respondent-level data, is processed only where your private offer or order puts it in scope. Projects on aggregated market, sell-in or sell-out data often involve no such personal data, though outlet records can (for example sole traders or named contacts).
• Roles. You are the controller. SightPulse AG is your processor. CBS Systems d.o.o. is our sub-processor.
• Contract. Our Data Processing Agreement applies automatically to every paid subscription and is designed to meet Art. 28 GDPR and Art. 9 FADP. A countersigned copy is available on request.
• Switzerland. The European Commission recognises Switzerland as providing adequate data protection, so data can flow from the EU to SightPulse AG without further safeguards.
• Serbia. CBS Systems accesses data remotely from Belgrade. Serbia has no adequacy decision from Switzerland or the EU, so SightPulse AG and CBS Systems have signed the EU Standard Contractual Clauses (Module Three) with the Swiss adaptations required by the FDPIC and have completed a transfer impact assessment. Remote access from Serbia counts as a transfer even when the data sits in your tenant or in Germany, so these safeguards apply in both cases. Data stays at rest in your tenant or in the EU Processing Environment, and personal data is pseudonymised by default where the use case allows, which limits the identifiable data accessible remotely. Serbia’s Law on Personal Data Protection (2018) is modelled on the GDPR.
• Individual-level consumer data. Where you use SightPulse on CRM, loyalty or CDP data, including linking records across your sources, you decide the legal basis and carry out any data protection impact assessment required. We provide the description of the processing and the measures you need.
• On request. SCC copy (commercial terms redacted), transfer impact assessment summary, ISO/IEC 27001 Statement of Applicability, completed security questionnaires.

7. Sub-processors

Sub-processors that may process customer personal data on behalf of SightPulse AG:

Not sub-processors: Microsoft Azure for your own tenant, which you contract directly as your infrastructure provider, and any language model endpoint or AI service you connect yourself.

We give at least 30 days’ notice before adding or replacing a sub-processor. To receive notices, write to privacy@sightpulse.ai with the subject “Sub-processor updates”.

8. Documents

9. Report a security issue

If you believe you have found a vulnerability in the website or the platform, write to security@sightpulse.ai and give us reasonable time to fix it before any disclosure. We will not pursue good-faith researchers who follow this process and do not access, change or retain data that is not theirs.

Other questions: privacy@sightpulse.ai for data protection, legal@sightpulse.ai for contracts.