SECURITY EVIDENCE

Know the controls. Request the proof.

Review workspace access, data flows, retention and the evidence available for enterprise procurement.

Request the security pack

Three actions. Different access consequences.Current EntityReach behavior

Save an account planAvailable to authorised workspace members

The server checks current workspace membership when reading or changing saved work.

Enter an account ownerA planning label, not an invitation

Naming a colleague in the owner field does not grant them access to your workspace.

Create a brief linkA snapshot you choose to share

The link contains the saved brief, including notes. Only signed-in members of the same workspace can view it. Links expire after 30 days and can be revoked.

Request current certification scope and control evidence; requirements become commitments only when agreed in writing.

Identity and workspace access.

WorkOS provides authentication, session handling and organisation membership. Saved groups, labels, account notes and next actions are read and changed only after server-side workspace checks. Owners manage billing, team access and API keys; naming an account owner in a plan is only a planning label and does not grant access.

Data flows and credentials.

Company searches, selected company IDs and AI research questions are sent from the server to Global Database for the requested research. Provider keys remain server-side. Customer CRM credentials are encrypted and bound to the workspace; disconnecting the integration removes them. Stripe handles complete payment details, while EntityReach stores the identifiers and status needed to manage the subscription.

Sharing, retention and deletion.

Account briefs are deliberate fixed snapshots. Only signed-in members of the same workspace can open them; links expire after 30 days and can be revoked. Saved account work remains until it is deleted or the workspace is closed, subject to legal obligations and backup recovery. The Privacy notice and Data processing page describe the current retention and contracting detail.

Operational security and incidents.

The service applies browser security headers, protects authenticated routes and rate-limits sensitive public and data operations. Suspected security issues should be reported to nbuldumac@globaldatabase.com without including passwords or API keys. Incident-notification periods, response targets, audit rights and service levels apply only where they are evidenced and agreed in writing.

ISO 27001 evidence and scope.

The operator, Global Data Intelligence Limited, maintains ISO/IEC 27001 certification. Enterprise reviewers can request the current certificate, issuer, validity dates and statement of applicability to confirm the exact scope. This statement does not imply that every EntityReach component or supplier is automatically within the certified scope.

A procurement route with evidence.

Request the current security pack for the available certification evidence, architecture and data-flow answers, service-provider information, retention and deletion detail, business-continuity context and vulnerability-management responses. Send your questionnaire and required contractual positions early; requirements are assessed against current evidence rather than accepted by implication.

THE DETAILS THAT MATTER

Before you start.

Can you complete our security questionnaire?

Yes. Send the questionnaire and review deadline with your request. We will answer from current evidence and identify requirements that need technical or contractual review.

Is the website itself an ISO 27001 certificate?

No. Request the current certificate and scope documentation and confirm whether it covers the services relevant to your proposed use.

Are breach response times or service levels standard?

No universal response time or SLA is promised on this page. Enterprise commitments must be agreed in the applicable order or service agreement.

YOUR NEXT STEP