Trust
Security & Data Processing
Last updated: 22 July 2026
This page explains, in plain terms, where your data lives, who processes it, and how we protect it, for teams including IT and data-protection leads assessing Sena. It complements our Privacy Policy and Terms & Conditions. Contact: hello@senabot.ai
Our commitments at a glance
- Your data is stored in the United Kingdom (AWS London, eu-west-2).
- We never sell your data, to anyone, for any purpose.
- OpenAI does not train its models on your data.
- Encrypted in transit and at rest, with per-customer data isolation.
- DPA and DPIA support available on request.
01Data residency: where your data is stored
All of your data (your account, your knowledge base, uploaded documents, and end-visitor conversations) is stored in a Supabase database running on Amazon Web Services in the United Kingdom (London region, eu-west-2). Your stored data does not leave the UK.
02Sub-processors
We use a small number of trusted providers strictly to run the service. We do not add data-sharing partners beyond these.
| Provider | What it does | Where | Safeguards |
|---|---|---|---|
| Supabase (on AWS) | Database, authentication, file storage | UK (London, eu-west-2) | Encryption, RLS, SOC 2 (AWS) |
| OpenAI | Generates AI responses; processes training content | US | SCCs + DPA; no training on your data |
| n8n Cloud | Workflow automation | EU | Encryption in transit |
| Stripe | Payments | EU / US | PCI-DSS Level 1 |
| Resend | Transactional email | EU (Ireland, eu-west-1) | Encryption in transit |
| Cloudflare | Hosting, CDN, DDoS protection | Global edge | TLS, WAF |
03AI processing and OpenAI: the details
Sena's assistant is powered by the OpenAI API. When it answers a question or processes content you add to train it, the relevant text is sent to OpenAI. Here is exactly what that means for your data:
- Not used for training. OpenAI does not use data submitted through its API to train or improve its models. This has been OpenAI's default since 1 March 2023.
- Short retention, then deleted. OpenAI retains API data for up to 30 days for abuse monitoring, then deletes it, unless legally required to keep it.
- Processing location. OpenAI is US-based, so this specific processing may occur outside the UK/EU. It is covered by Standard Contractual Clauses and OpenAI's Data Processing Addendum.
Official OpenAI references:
- Enterprise privacy & training commitments: openai.com/enterprise-privacy
- API data controls ("How we use your data"): platform.openai.com/docs/guides/your-data
- Data Processing Addendum: openai.com/policies/data-processing-addendum
- Policies hub: openai.com/policies
Distinction that matters: your data is stored in the UK. When the AI generates a reply, that one step is processed by OpenAI under the safeguards above. We keep these separate deliberately so we describe them accurately.
04Security controls
- Encryption in transit (TLS 1.2+) and at rest.
- Per-customer isolation via row-level security, so each account can only access its own data.
- Authentication with secure password hashing and Google sign-in.
- Signed access tokens for chat widgets so conversation data can't be read by unauthorised parties.
- Least-privilege access to production systems.
05We do not sell your data
We do not sell, rent, license, or trade your data or your visitors' data to any third party, and we do not use it for advertising. Data is shared only with the sub-processors above, only to run the service.
06Data retention and deletion
- Account and knowledge-base data is kept while your account is active and deleted within 30 days of closure (unless legally required otherwise).
- You can request deletion of specific end-visitor conversations at any time.
- On request, we provide written confirmation of deletion.
07Data protection support
- We can sign a Data Processing Agreement (DPA) with you, under which we act as your processor.
- We support your Data Protection Impact Assessments (DPIAs) by providing the information on this page and answering security questionnaires.
- In the event of a personal-data breach, we will notify affected customers without undue delay and cooperate as required under UK GDPR.
08Contact
For security questions, a DPA, or a completed security questionnaire, email hello@senabot.ai.