Security
Where Pozy stores customer data, which subprocessors handle it, how long it is kept and how to ask for deletion.
This page says where your data lives while Pozy works with it, who else handles it, and how long it is kept. The legal terms are in the privacy policy, the data processing agreement and the subprocessors list.
#Where data is stored
| Data | Where | Region |
|---|---|---|
| The website, dashboard, API and MCP server | Vercel | United States (US East) |
| Workspaces, members, API key hashes, webhook settings, billing records and logs | Neon (Postgres) | United States |
| Connected accounts, their access tokens, and the posts, media, messages and analytics that pass through them | The platform connectivity provider | European Union |
| Payments and invoices | Stripe | United States |
A workspace cannot choose its region today. If you need data kept in a specific region, write to support@pozy.ai and tell us which one.
#Subprocessors
Pozy uses a small set of subprocessors, each listed with what it does and where on the subprocessors page. The provider that connects to social, messaging and ads platforms is listed there by category. Customers can ask for the full named list under the data processing agreement at support@pozy.ai.
We announce a new subprocessor on that page before it starts processing customer data. To get an email when the list changes, write to support@pozy.ai.
#Retention
| Data | How long it is kept |
|---|---|
| A closed workspace's logs, events, webhooks, API keys, sessions and support history | Deleted within 30 days of closing it |
| A closed workspace's connected profiles and accounts | A minimal record (names and identifiers) is kept, to keep them disconnected and out of other workspaces |
| Connected account data: posts, messages, comments, analytics | Until you disconnect the account or close the workspace |
| API request logs and webhook delivery logs | 90 days. GET /v1/logs and Logs show this window |
| Billing records: invoices and payment history | Seven years, because tax and accounting law requires it |
| Database backups | Up to 30 days, then they expire |
#Deletion requests
- A connected account. Disconnect it in the dashboard or with
DELETE /v1/accounts/{accountId}. Publishing to it stops at once. - A workspace. The owner can delete it under Settings → Workspace. Its logs, events, webhooks, API keys, sessions and support history are deleted within 30 days, and backups expire within a further 30 days. A minimal record of the profiles and accounts it had connected is kept to keep them disconnected and out of other workspaces. Billing records are kept as the law requires.
- One person's data. Write to support@pozy.ai from the address on the account, or as the workspace owner for a member or a contact in your inbox. We answer within one month.
If your own customer asks you to delete their data, you are the controller for it: delete it through the API or the dashboard, or ask us to help under the data processing agreement.