Security and the EU

How we protect your data

• Data is encrypted in transit (HTTPS/TLS), including between GoalCube and the database.
• Customer data is stored in the EU with Clever Cloud (PostgreSQL and a weekly encrypted copy in FS Bucket, Paris). In production, the system will not start without the database and the encryption key.
• Each company's data is kept in its own area. On every change, automated tests show that a company cannot view, change or delete another company's data.
• Customer data is encrypted in GoalCube (AES-256-GCM) with a key per company before it is stored. The companies' keys are themselves encrypted with a master key that only GoalCube's operations staff have access to. On deletion, the key is deleted too.
• A limit on the number of requests per IP address on all pages, and a stricter limit for sign-up, login and invitations. The IP address is used only in memory for no more than one hour and is not stored.
• GoalCube keeps a security log of, for example, failed logins, the creation and deletion of accounts and users, displays of real values, large exports and emails that could not be sent. It contains only the time, the event, the company's random ID and fixed codes, counts or technical information such as a payment reference, invoice number or cause – never names, emails, IP addresses or content. It is kept for 12 months and then deleted in whole months (no later than 13 months after). Copies in backups (the hosting provider's and GoalCube's own weekly copy) may remain for up to 30 days longer.
• If an error occurs, the user sees an error code (e.g. GC-7K3Q9MXA) that can be given to GoalCube. GoalCube's error log stores only the time, the error code, the type of error, the first part of the address (without keys), the status and the company's random ID – never the text of the error message, content, names, emails or IP addresses – and is deleted after 90 days. Copies in backups (the hosting provider's and GoalCube's own weekly copy) may remain for up to 30 days longer.
• From 18 October 2026, the audit log contains only the random IDs of the user and the dataset, fixed codes, counts and amounts – no names. Older entries (before 18 Oct 2026) may contain names of users (for payments), datasets, columns and AI connections as well as error texts; they are not changed (hash chain) and are deleted with the company's other data.
• The customer can always terminate the agreement or delete all data in GoalCube itself. After termination, all data is deleted automatically after 30 days, and until then the termination can be undone. With "Delete everything now", data, users, the audit log and the company's encryption key are deleted immediately. Copies in backups – the hosting provider's and GoalCube's own weekly, encrypted copy at the same provider in Paris – are deleted when they expire, no later than 30 days after the deletion. GoalCube confirms the deletion by email. Exempt are GoalCube's invoices, credit notes and accounts (company name, address, VAT number, amount, payment reference, for 0% VAT the VIES date and consultation number, and the time of the declaration of buying as a business), which the Danish Bookkeeping Act (bogføringsloven) requires to be kept for 5 years after the end of the financial year, and a checksum of the country and VAT number if the company has had its money back, so that the offer is used only once (5 years).
• Payment: the server calculates the amount and VAT; SumUp receives only a random customer number, the plan, the period, the VAT type and the amount – never the company name, address, VAT number or email. After a cancellation, the card stays with SumUp until the end of the paid period (so that the cancellation can be undone), and it is deleted immediately if the company deletes all data. Each payment gets one invoice with a sequential number. VAT numbers from other EU countries are checked in the European Commission's VAT Information Exchange System (VIES); GoalCube stores only the result, the time and the consultation number.
• Once a week, GoalCube makes an additional copy of all data, encrypted as in the database. It is kept at the same hosting provider in Paris, but outside the database. The four most recent copies are kept (no more than 28 days), and each copy is automatically test-restored.
• All pages have security rules (including CSP), so the browser runs only GoalCube's own scripts – except SumUp's card field on the payment page – and the pages cannot be displayed inside other websites.
• AI services are connected by logging in to GoalCube (OAuth 2.1 with PKCE) – no key appears in the address. The user gives consent with their passkey, sees where the response is sent and can always view and disconnect connections. GoalCube stores only checksums of the keys; a connection expires after 180 days at the latest and stops immediately when the user is removed or the agreement is terminated.
• AI services the customer connects receive pseudonyms instead of the values in the columns the customer protects, and instead of the customer's secret terms. In free text, GoalCube also detects names, emails, ID, phone and account numbers and addresses using lists and patterns and replaces them with pseudonyms. An item of data may exceptionally slip through, for example a name that is not on the lists, or an address or number written in an unusual way. The customer can see what the AI sees before the dataset is saved.
• Uploaded files are not stored; only the extracted text that the customer has chosen to save as a dataset.
• Decisions, confirmations and changes are recorded in an audit log with checksums (hash chain) and independent timestamps. Each company has its own chain, and every day a combined fingerprint of all chains receives an independent timestamp.
• Secret terms are never stored in the audit log.
• The pages load no files from others (for example fonts from Google). The only exception is the payment page, where the card field comes directly from SumUp, so card details never reach GoalCube. The system sets no tracking cookies.
• Emails to contact@goalcube.eu are read and answered in the mailbox at Simply as long as GoalCube's mail agent is switched off. When the mail agent is switched on, emails that need a human reply are read and answered in GoalCube, and the staff member only gets a notification, without the content, in their own inbox.
• Access keys are not written to the server log.
• Only GoalCube staff who need it have access to operations and data, and they are bound by confidentiality.

Where data is stored

All customer data is stored with Clever Cloud SAS, Paris region (Clever Cloud zone "par"), France. See all sub-processors in the data processing agreement.

Our commitments

• Notice of a personal data breach no later than 48 hours after we discover it.
• Notice 14 days before we start using a new sub-processor.
• You can always delete all data yourselves, straight away. After termination, everything is deleted within 30 days.
• Copies in backups are deleted no later than 30 days after deletion.

Status of the controls

ISO/IEC 27001:2022 has 93 controls. The figures come straight from our information security management system (ISMS) and are updated automatically.

Report a vulnerability

If you have found a security flaw, write to contact@goalcube.eu with "security" in the subject line. A human reads every security report. security.txt

Independent testing

An independent security test (penetration test) is planned once a year.