Explainer11 min read

Where your data lives, and who can see it

Last updated 21 October 2026The same on every plan. Data is hosted in the United States, and there is no EU or India hosting option today.

This page is written to be forwarded to a security reviewer without editing. It says where the data sits, which parts of it are held per workspace rather than pooled, how long each kind is kept, how credentials are protected, and exactly who at MarqIQ can open your workspace and what is recorded when they do. Where something is not yet built, it says that too, because a limit a reviewer finds themselves costs more than one we state.

The short version

Hosted in the United States. Vercel runs the application, Neon runs the databases.
The records synced from your connected tools live in a database created for your workspace, not in a table shared with other customers.
Credentials for your connected tools are encrypted before they are stored and are never sent back to a browser.
Your records are not deleted on a timer. A workspace that stops paying goes read-only and keeps everything. Two things MarqIQ derives from your records are kept for twelve months and then pruned: the change log and the daily figures, both named below.
A named list of MarqIQ staff accounts can open a workspace, and doing so writes a row into that workspace's own activity log.
MarqIQ holds no SOC 2 and no ISO 27001 certification and does not claim one.

One store per workspace

MarqIQ splits your data in two, and the split is the answer to most of what a reviewer asks.

What	Where it sits
Accounts, workspaces, roles, connections, saved reports, form submissions captured by the tracking script, sync logs and the activity log	A shared control database.
Records synced from your connected tools — contacts, companies, deals, deal contacts, engagement events, the raw payloads behind them, sync failures, spreadsheet datasets, change sets and computed results	A database created for your workspace alone.
The change log of your synced records, the daily figures, and the reports agents keep	The same per-workspace database.
Which agents run, when each ran, and to whom a report went — counts, ids and the report’s headline, never a record or an address	The shared control database, as the activity log is.

A workspace's database is created the first time something actually writes tenant data for it, rather than at sign-up. Until then nothing of yours exists in either place beyond the account itself.

The exception, stated

Two kinds of workspace keep their synced records on the shared control database and are never moved without a deliberate migration: workspaces created before per-workspace databases existed, and workspaces created while the provisioning key was absent from our environment. The rule that decides this is structural — a workspace's tenant data lives in exactly one database for its whole life — because the alternative is half a customer's contacts in one place and half in another.

Whichever database holds it, every query is scoped to one workspace. The workspace comes from the session or, for an AI assistant, from the token; there is no parameter anywhere that names a different one, so no wording of a request reaches another customer's data.

How long each kind is kept

What	How long
Everything in your workspace	Until you ask us to remove it. Nothing is pruned for age and nothing is pruned for non-payment.
The raw payload a tool sent, kept beside the mapped record	30 days. It exists so that changing a field mapping re-reads what was already fetched instead of walking the vendor's API again.
The change log: a deal’s stage, outcome, owner, amount and close date; a person’s lifecycle stage, lead status and owner; a company’s lifecycle stage and owner; a record leaving the tool	12 months, pruned in small batches. Each row holds the record’s id in the tool, the field, the old and new value and when MarqIQ saw the change — never an email address.
The daily figures: once a day per tool, people and companies by lifecycle stage, people with no owner, deals by outcome with their money per currency, duplicate groups and data-quality scores	12 months for the daily rows; each month’s last figure is kept beyond that. Counts only, never a person’s value.
An agent’s report — the Monday Brief, an alert, the pipeline check	With everything else in your workspace: it goes on erasure and when the workspace is deleted.
An address the email provider said bounced or complained	As a lower-cased address with the provider’s reason and the event id, nothing else, for as long as it must not be emailed again.
Your Slack connection	The Slack workspace’s id and name, the MarqIQ app’s bot token encrypted at rest, the permissions granted, who connected it and when, and when it was disconnected; per person, the Slack user id found by the email they sign in with, kept so a DM is looked up once.
First-party last-touch cookies on your own site	7 days from the last attributed touch.
First-touch cookies, the anonymous visitor id and the sentinel	Up to one year. Safari and other browsers with tracking prevention cap any cookie set in the browser at 7 days regardless.

Take care

There is no automatic retention pruning yet. Submissions and stored error events are kept until they are deleted by request, and there is no per-workspace retention window you can set. If your own policy needs a shorter one, say so and it becomes a scheduled deletion we run for you.

How it is protected

Credentials for a connected tool are encrypted with AES-256-GCM under a key held in our environment, stored as a versioned envelope, and never returned to a browser.
Account passwords are hashed, never stored or recoverable. Two-factor authentication is available, accounts lock after repeated failed sign-ins, and sensitive endpoints are rate limited.
A signed-in session lasts seven days.
An AI assistant access token is stored only as a SHA-256 fingerprint, so our own database is not a set of working keys. It is shown to you once and can never be shown again.
The credentials you give MarqIQ for a tool are the ceiling on what MarqIQ can do to that tool. A token granted read-only scopes cannot write, whoever asks.

Who at MarqIQ can open your workspace

Staff access is a short, explicit list of email addresses held in our own environment. It is deliberately not a check on an email domain, because anyone who could register an address on that domain would then be able to grant it to themselves.

A staff member opening your workspace writes a row into your workspace's own Activity Log, under the Team screen, with their name against it.
One staff account can never open another staff account's session, so the trail cannot be laundered between them.
The session ends when that staff member's own password expires rather than running for the usual seven days, and the saved original session is held for at most eight hours.
The live chat widget is not drawn while a staff member is in your workspace, so no chat is ever opened under your name by somebody who is not you.

Note

The row exists and is mislabelled. The activity log has no wording of its own for a staff sign-in yet, so it falls back to the default and the event column reads Role updated. Read the Performed by column: a name that is not one of your colleagues is a staff session, and support can confirm the date.

Who else is involved

Company	What for
Vercel	Hosting and serving the application.
Neon	The control database and every per-workspace database.
Resend	Transactional email — invitations, case notifications, password resets — and the emails agents send: the Monday Brief, alerts and the pipeline check, from a no-reply address on our own domain. Resend tells MarqIQ when one of those bounced, was reported as spam, was delivered or was delayed.
Slack	Only when a workspace admin connects it: agent reports posted to the public channel the admin picked and sent as DMs to recipients who keep Slack on — counts, figures, deal names with a link into your tool, your colleagues’ names as owners; never a contact’s name, email or phone. MarqIQ reads no message in Slack. Slack tells MarqIQ when the app is removed or its token revoked, and nothing else.
Razorpay, Cashfree and Stripe	Payments. Card details go to the provider and never pass through MarqIQ.

The full sub-processor list is available on request, and we tell customers before adding one that handles personal data. There is no published DPA template yet; if your procurement needs one, raise a case early rather than at signature.

The tools you connect yourself — HubSpot, Salesforce, Marketo and the rest — are yours rather than ours. MarqIQ reaches them with the credentials you supply.

What an agent email holds, and how it stops

An agent email is the report itself: counts and money figures with the count each rests on, deal names with a link into your tool, the names of your own users as deal owners, and the three things to do. No contact’s name, email address or phone number is written into one, and a headline — the part that travels in the subject line and the inbox preview — is refused before the report is kept if it holds an address or a phone number.

Every agent email carries a one-click unsubscribe link, the kind Gmail and Yahoo show as an Unsubscribe button, and the same link at its foot. One click stops that kind of email, or every agent email, for that person; in-app reports are not affected, and the switch can be turned back on under Account settings › Notifications.
An address the email provider reports as permanently bounced is put on a suppression list and is not emailed by an agent again. An address that reports an agent email as spam is suppressed too, and every agent email is switched off for that person. Each switch stays off until the person turns it back on.
A workspace admin decides who receives an agent; only the person decides whether it emails them.

AI providers, and which one sees real people

Most AI work in MarqIQ reads figures rather than people. One does not, and it is named here rather than buried.

AI enrichment is the only feature that sends real contact details — name, email address, company, job title, country and industry — and it runs only on AI accounts your workspace connects, never on an account of ours.
Template drafting runs only on AI accounts you connect, and of your data it sends only the text you type into it.
AI answer tracking and the leadership brief prefer your own accounts and can fall back to included ones. Under Account & Team then AI & Providers you can require that they use only accounts you own, and with that on they never fall back.
Your relationship with those providers is your own. A free tier can carry terms a paid tier does not — Google, for example, may use content sent to the free tier of the Gemini API to improve its products.

What the tracking script does not do

This is the part a website visitor's own privacy team asks about, and it is a short list because the script is narrow on purpose.

No fingerprinting, no session recording, no heatmaps and no mouse tracking.
No advertising or social pixels, and no cross-site tracking. The cookies are first-party and work only on the site that set them.
No IP address is stored against a visitor or a form submission.
No personal data is sold or shared, in any role.
Global Privacy Control and Do Not Track are honoured as an opt-out that a MarqIQ customer cannot switch off: no cookie is written and nothing is sent.

Deleting one person's data

MarqIQ can export and erase what it holds for one email address in your workspace. An erasure removes the form submissions captured by the tracking script, the contacts synced from your connected tools, every open, click and bounce recorded for that address, the tool’s raw payloads and any failed-sync copies of the record, the person’s links to deals, a Pipedrive lead that is the person, the rows a spreadsheet import made from their own row, the writes MarqIQ had proposed about them, and the workspace’s cached analyses. It is scoped to your workspace, restricted to workspace admins, and written to the activity log with the email address as its key.

It also says what it does not remove, and why: a company record, which belongs to every contact at that company; a deal the person was attached to, which is the company’s record; the names of your own users as record owners; an alternate address held only inside a contact’s properties; and the audit entry of the erasure itself. And an erasure in MarqIQ is not an erasure in your tool — while the person still exists there, the next sync brings them back, so delete them at the source as well.