Security, data handling, and model use
DoneHat is built for teams that need to understand what data is stored, which AI systems are used, who can access brand-account actions, and how billing and operational records are handled.
Data inventory
What DoneHat stores
DoneHat stores the data required to monitor AI visibility, diagnose issues, coordinate fixes, and prove changes over time. We separate public audit snapshots from signed-in brand-account data.
Brand-account data
We store account metadata, brand-account settings, brand facts, competitors, buyer questions, answer checks, issues, actions, proof checks, team membership, and audit logs needed to operate the product.
AI monitoring data
Answer snapshots include the buyer question, platform, answer text, cited sources, mention detection, competitor mentions, confidence signals, and timestamps so you can audit why a score changed.
Billing data
Freemius handles checkout, invoices and recurring billing when named as merchant of record. DoneHat stores subscription status and provider references, not full card numbers.
Access control
Brand-account permissions are explicit
DoneHat treats brand-account IDs, action IDs, report IDs, job IDs, and API keys as untrusted input. Access is checked server-side before returning data or accepting mutations.
Authenticated app routes require a valid session or API key.
Brand-account data is scoped by owner, editor, and viewer roles.
Sensitive integration writes and publishing actions require owner or editor access.
Public API access is limited to Pro and Enterprise plans and rate-limited.
Production requires PostgreSQL availability and exits instead of silently falling back to local development storage.
Email, billing, API key, and brand-account operations are logged for operational visibility.
AI systems
How DoneHat uses AI models
What is sent to models
DoneHat sends the minimum context needed for analysis: buyer-question text, public answer text, configured brand facts, competitor names, and relevant public page content. We do not need CRM records, private analytics, or customer databases to monitor AI visibility.
What is returned
Models and answer sources return answer text, source URLs, classification signals, confidence scores, and fix drafts. Those outputs are stored in your brand account so your team can review and prove them later.
Human control
DoneHat can draft content fixes, schema, briefs, and recommendations, but publishing is controlled by your team. Agent approvals and execution actions are gated by brand-account permissions.
Retention
Brand-account data is retained for the life of your subscription unless you delete a brand account or request deletion. Public marketing audits are snapshots and may expire separately from signed-in brand accounts.
Exports
Reports, PDFs, issue exports, API keys, and brand-account activity are designed so teams can audit evidence, share outcomes, and move data into their operating workflows.
Questions
For vendor reviews, data deletion, security questions, or procurement details, contact us and include your company name and account email.
Need a security answer for procurement?
Send us the review context and we will route it to the right owner.