Exactly how ONX handles
your data and uses AI.
Written for security reviewers, legal teams, and procurement. No marketing language — just the specific, verifiable answers to the questions you actually ask.
EU database
Stockholm (eu-north-1)
No PII to AI
No names, emails, or deal data
Auto-deletion
Enforced by pg_cron at DB layer
Human review
Required before every AI action
No model training
Contractually prohibited with all AI providers
No automated decisions
AI is decision-support only
What ONX stores
Data you create or import — persisted in your account
Deal rooms
LowRoom name, deal value, close date, pipeline stage, CRM deal ID
Companies
LowCompany name, domain, industry. CRM sync stores domain and industry only — no financials, no company contacts.
Contacts
MediumFirst name, last name, job title, business email, LinkedIn URL. Stored only if added by your team.
Assets
Low–MediumFile metadata (title, type, size, upload date). File content stored in encrypted object storage.
CRM sync data
LowDeal-level commercial fields (stage, value, close date, owner ID). Contact associations stored as IDs only — no contact names or emails imported from CRM.
OAuth tokens
High — isolatedHubSpot access and refresh tokens — encrypted at rest, service-role only access, never exposed to client-side code.
Special category data (health, race, religion, etc.) is not processed — category blocked at ingestion. Article 9 GDPR.
What ONX tracks
Behavioural events generated when people interact with your rooms and assets
Asset downloads
Asset performance analytics; rep engagement viewTimestamp, viewer email (authenticated users only), source context, pseudonymised IP
Deal room views
Buyer engagement scoring; deal health signalsViewer email and name (collected via email gate — see consent notice), content interactions, duration
NBA actions
Win-rate attribution; effectiveness analyticsAction type, deal ID, rep who acted, timestamp, outcome (won/lost/stalled)
Rep activity
Pipeline health; manager visibilityActions per deal, last active timestamp — no keystroke or screen recording
IP addresses are never stored in plaintext. ONX applies HMAC-SHA256 pseudonymisation with a daily rotating salt — same IP on the same day produces the same hash (for deduplication); different day produces a different hash (no cross-day tracking). The secret key is held separately; hashes cannot be reversed without it.
Retention periods
Enforced at the database layer by scheduled jobs — not a policy statement, a mechanism
Auto-expiry enforced — no silent renewal without lawful basis re-confirmation
pg_cron job runs nightly. Deleted after 90 days of no activity.
Viewer email and pseudonymised IP auto-deleted after one year
Viewer email, name, and IP hash auto-deleted after one year
View-table PII anonymised immediately on erasure request. Account and residual data deleted within 30 days.
Access and refresh tokens removed immediately when CRM integration is disconnected
Retained for legal and regulatory compliance purposes
Retention jobs run at the database layer (PostgreSQL pg_cron), not the application layer. This means they execute regardless of application deployments or API availability. Deletion is logged in the audit trail.
AI-assisted features
Every AI feature in ONX — what it does and what model it uses
Email draft
Writes a first-draft cold outreach email for a contact based on company signals, news, and ICP context.
Rep clicks "Draft email" — never automatic
Executive summary
Generates a boardroom-ready pipeline briefing from aggregate deal health, activity, and win-rate data.
Rep/CRO clicks "Generate" — never automatic
Signal scoring
Scores market intelligence signals (hiring patterns, intent data) for relevance to the ICP.
Background job — output is a score, not a decision
News relevance scoring
Evaluates news articles for commercial relevance to target accounts.
Background enrichment — surfaced as context, not instruction
What is sent to AI providers
The exact fields included in prompts — specific, not approximate
Email draft
Executive summary
Signal / news scoring
What is never sent to AI providers
Explicit list — not a general statement
Model training: Anthropic and all other AI providers used by ONX are contractually prohibited from using your data to train or fine-tune their models. This applies to all plans.
Human oversight model
How ONX ensures AI output is never acted on automatically
EU AI Act alignment: ONX's preliminary internal assessment classifies the platform as a limited-risk AI system. All AI-generated content is transparently labelled per Article 52. No high-risk use cases (employment, credit, law enforcement, healthcare) are in scope.
Subprocessors
Every third-party service that touches customer data
30 days' notice is provided for new subprocessors. DPA available on request.
EU hosting
Where your data physically resides
All customer data at rest. EU territory. GDPR territorial requirement satisfied.
Assets, uploads, generated documents — same region as database
Serverless functions run at the edge nearest the user by default
Data-in-transit to AI providers is covered by SCCs. See 'What is sent to AI' for field-level detail.
Transactional emails only (confirmation, erasure notifications). No customer contact data in email payloads.
Data residency commitment: All structured customer data (deals, contacts, companies, assets, view events) is stored in the EU (Stockholm) and does not leave the EU except where explicitly described above — specifically the limited fields sent to Anthropic for AI inference, covered by SCCs and DPA.
Questions or need a DPA?
We respond to procurement security questions within 2 business days.