Trust

What crosses, what stays, and what never comes in at all.

Behavioral data earns its keep only if the people it describes and the teams who use it can trust how it is handled. These are the rules the platform enforces, and the plain status of every framework we work to.

Data handling

Three lists your security team will ask for.

Crosses the boundary

SHA-256 hashed email and phone
UID 2.0 tokens
Outcome labels you choose to share

Stays in your environment

Names, addresses and raw identifiers
Customer records and transaction history
Anything you haven’t agreed to send

Never enters the platform

Protected health information
Data about minors
EU and UK personal data

Controls

Rules the platform enforces, not promises in a deck.

Separate instances
Each client’s data lives in its own instance. It is never pooled with another client’s, and identifiable client data never trains a model other clients use.
Encrypted and U.S.-hosted
AES-256 at rest and TLS 1.2 or higher in transit. The data platform runs in U.S. cloud regions on private networking, with no public database endpoints.
Access kept narrow
Single sign-on and multi-factor authentication on core systems, role-based access reviewed every quarter, and logged production access.
Hashed on the way out
Audiences leave as SHA-256 hashes. Inside the workspace, identifiers are masked, and there is no way to look up an individual.
A gate before every model
No model is published until it beats a demographic and a lookalike baseline on a holdout you own. Kill decisions are logged with the reason.
Labels on every score
Each published model says what it estimates, what it isn’t for and where it is weak, and carries a version and a date.
Permitted uses, documented
Marketing and engagement only. Never credit, insurance, employment, housing or any other eligibility decision.
Incident commitment
No security incidents or breaches to date. If one ever affects your data, you hear from us within 72 hours.

Trust

Built to pass the review before it reaches your legal team.

The discipline that held up in public is the discipline we sell. Here is exactly where each framework stands, in plain words, because a badge on its own tells a reviewer nothing.

Report available under NDA
Observation period from Q4 2026, report targeted for 2027
No PHI ingested, by design. Readiness assessment in progress
Consumer rights program in place. Global Privacy Control honored
Controls aligned. No EU or UK personal data in the product
Control set aligned, self-assessed
Controls mapped across all six functions

The lines we don’t cross

01Marketing and engagement only. Never used for credit, insurance, employment, housing or any eligibility decision.
02Modeled ethnicity and political ideology are never selectable, never model inputs and never exported.
03No data about minors, and no way to look up an individual.
04Your data stays in its own instance, and identifiable client data never trains a model other clients use.
05Identifiers leave as SHA-256 hashes. Raw personal information stays inside the platform.
06Every model has to beat a demographic and a lookalike baseline on your holdout. Kill decisions are logged.
07No security incidents or breaches to date, and a 72-hour notification commitment to clients.

Documents and contacts

Everything a reviewer needs, in one place.

For questionnaires, the security packet or a vulnerability report, write to security@moonbrush.com. For privacy requests, use Your Privacy Choices.