Security & Trust at ModelMonkey
Built with security and privacy at our core. We're committed to protecting your data and being transparent about our practices.
Infrastructure & Hosting
Where your data lives and how it's protected
Server Location
Our primary servers are hosted in Singapore, providing low latency for Asia-Pacific users while maintaining high security standards.
Database Security
We use PostgreSQL with encryption at rest and SSL connections. Our database is not accessible from the internet, providing an additional layer of security.
Content Delivery
All connections use HTTPS/TLS encryption to protect data in transit. Your data is never transmitted over unencrypted connections.
Key Management
Sensitive data encryption keys are managed using Google Cloud KMS, providing enterprise-grade key security and rotation capabilities.
Data Protection
How we keep your spreadsheet data secure
Encryption
In Transit: All data is encrypted using HTTPS/TLS
At Rest: Database encryption with AES-256
Keys: Managed through Google Cloud KMS
Data Retention
Spreadsheet access: We process the spreadsheet data needed to complete your request and apply approved changes.
Purpose limitation: Data is handled to provide, secure, support, and operate ModelMonkey.
Details: See our Privacy Policy for our data practices.
No AI Training
We process data to provide ModelMonkey. Your spreadsheet data is not used to train AI models.
Session Security
Authentication tokens expire and access is protected by provider OAuth.
Authentication & Access
How we verify your identity securely
OAuth Authentication
We use Google OAuth and Microsoft OAuth for authentication. We never see or store your passwords.
Secure Tokens
Session tokens use JWT (JSON Web Tokens) with 24-hour expiration and are signed with secure HMAC algorithms.
Minimal Permissions
We only request the minimum necessary permissions to access your Google Sheets. We cannot access other files in your Drive.
No Password Storage
We never ask for or store your Google or Microsoft passwords. All authentication is handled through their secure OAuth systems.
Third-Party Services
Trusted partners we work with
Anthropic Claude (AI Processing)
What we share: Only spreadsheet content relevant to your specific request
Data handling: Used to provide the requested AI response, not to train AI models or target advertising
Location: Anthropic's secure cloud infrastructure
Stripe (Payment Processing)
What we share: Payment information and subscription details
Security: PCI DSS Level 1 certified (highest level of payment security)
Google & Microsoft APIs
Purpose: Reading from and writing to your spreadsheets
Security: OAuth tokens, no password storage, minimal API scopes
Brave Search (Web Search)
What we share: Only your search query text
Privacy: We do not send your spreadsheet data with web search requests
Compliance & Certifications
Our commitment to security standards
Current Status
We are working towards ISO 27001 and SOC 2 Type II compliance. These certifications demonstrate our commitment to information security management.
Privacy Laws
We comply with GDPR (General Data Protection Regulation) and CCPA (California Consumer Privacy Act) requirements.
Google Workspace Verified
ModelMonkey is a verified Google Workspace add-on, meeting Google's security and privacy standards for Marketplace apps.
Data Protection Officer
For privacy-related questions or to exercise your rights under GDPR/CCPA, contact our Data Protection Officer at [email protected]
Our Privacy Principles
What we promise our users
No Data Selling
We will never sell your data to third parties. Ever.
No Advertising
Your data is never used for targeted advertising.
Minimal Collection
We only collect data necessary to provide our service.
Transparency
Clear privacy policy with detailed data practices.
User Requests
You can contact us to request access, correction, or deletion of personal data.
No AI Training
Your spreadsheet data is not used to train AI models.
Frequently Asked Questions
Where is my data stored?
Your workbook remains in Google Sheets or Excel. ModelMonkey processes the data needed to complete your requests. Our primary servers are in Singapore, and database storage is encrypted at rest. See our Privacy Policy for details.
Who has access to my spreadsheets?
ModelMonkey uses the spreadsheet permissions granted through your Google or Microsoft account and accesses sheet data when you use the service. Authorized personnel may access operational systems only when needed for support, security, or legal obligations, subject to access controls.
How long do you keep my data?
Retention depends on the type of data and why it is needed. See our Privacy Policy for details, or contact us if you want to make a data request.
Is my data used to train AI models?
No. We do not use your spreadsheet data to train AI models. Third-party processing is described in our Privacy Policy.
What happens if I delete my account?
Account and data-deletion requests are handled under our Privacy Policy, subject to security, billing, and legal retention requirements. Contact [email protected] to make a request.
Do you comply with GDPR and CCPA?
Yes. We comply with both GDPR (for EU users) and CCPA (for California users). You have the right to access, rectify, erase, restrict processing, port your data, and object to processing. Contact our Data Protection Officer at [email protected] to exercise these rights.
How do you handle security incidents?
We have structured logging, monitoring, and incident response procedures in place. In the event of a security breach affecting personal data, we will notify affected users and relevant authorities as required by law.
Questions About Security?
For security or privacy questions, contact our Data Protection Officer
Contact DPOFor more details, read our Privacy Policy and Terms of Service