Security Policy
Last updated: June 2026
At Segment8, security is fundamental to how we build, operate, and maintain the platform. Our customers trust us with competitive intelligence, customer insights, positioning, launch plans, and other commercially sensitive information. Protecting that data is a core responsibility.
Your data, your ownership
Customer data is never sold, shared, or used to train foundation models.
Encrypted end to end
Data is encrypted in transit with TLS and at rest using infrastructure-level encryption.
Least privilege access
Workspace isolation and role-based permissions restrict access to the minimum required level.
Cloud-native infrastructure
Modern managed infrastructure with monitoring, audit trails, and automated backups.
Continuous monitoring
Logging and alerting systems monitor for unauthorised access, anomalies, and security events.
Responsible disclosure
Report vulnerabilities to [email protected]. We respond in good faith.
1. Security Principles
Our security programme is guided by five principles:
- Customer data belongs to the customer. Customer data is never sold, shared, or used to train foundation models.
- Least privilege by default. Access to systems, services, and customer data is restricted to the minimum required level.
- Security built into the product. Security is incorporated throughout the development lifecycle rather than added after deployment.
- Defence in depth. Multiple layers of protection reduce risk and limit the impact of potential incidents.
- Continuous improvement. Security threats evolve constantly. Our controls, processes, and monitoring evolve alongside them.
2. Data Protection
Customers retain ownership of all data stored within Segment8.
- Data residency: Customer data is stored using trusted cloud infrastructure providers and managed services.
- Encryption in transit: Data is encrypted in transit using TLS.
- Encryption at rest: Data is encrypted at rest using industry-standard encryption mechanisms provided by our infrastructure providers.
- Backups: Regular backups are maintained to support recovery and business continuity requirements.
- Data retention: Customers control the lifecycle of their data. Retention and deletion requests are handled in accordance with applicable regulations and contractual obligations.
3. Access Controls
Access to systems and customer data is strictly controlled.
- Authentication: User authentication is protected through modern authentication systems and secure credential handling.
- Role-based access: Access to customer workspaces is governed through role-based permissions.
- Workspace isolation: Customer data is logically isolated between workspaces.
- Internal access: Access to production systems is restricted to authorised personnel with legitimate operational requirements.
4. Infrastructure Security
Segment8 is built using modern cloud-native infrastructure and managed services.
Security measures include:
- Encrypted communications
- Network-level protections
- Environment isolation
- Access logging and audit trails
- Infrastructure monitoring
- Automated backups
- Security patch management
5. Application Security
We incorporate security practices throughout the software development lifecycle.
- Secure coding practices
- Dependency monitoring
- Vulnerability management
- Access control testing
- Code review processes
- Automated testing pipelines
- Environment separation between development and production
6. AI & Data Usage
No model training on customer data. Customer data is not used to train foundation models.
AI capabilities within Segment8 are used to support signal classification, summarisation, enrichment, pattern identification, and workflow automation. Strategic decisions remain under customer control.
AI-generated outputs should be reviewed and validated before use in critical business decisions.
7. Security Monitoring
We maintain monitoring and logging systems designed to identify:
- Unauthorised access attempts
- Service disruptions
- Infrastructure anomalies
- Operational incidents
- Security-related events
Alerts are reviewed and investigated as appropriate.
8. Vulnerability Disclosure
We welcome responsible disclosure of potential security vulnerabilities. If you believe you have identified a security issue, please contact [email protected].
When reporting an issue, please include:
- A description of the vulnerability
- Steps to reproduce the issue
- Potential impact
- Supporting evidence where appropriate
We ask researchers to act in good faith, avoid accessing customer data, avoid service disruption, and allow reasonable time for investigation and remediation before public disclosure.
9. Incident Response
In the event of a confirmed security incident, we will:
- Investigate and contain the issue.
- Assess potential impact.
- Implement remediation measures.
- Notify affected customers where required.
- Conduct a post-incident review and implement improvements.
10. Compliance & Privacy
Segment8 is committed to protecting customer data and complying with applicable privacy and data protection regulations.
For additional information, please refer to our Privacy Policy, Data Processing Addendum, and Terms of Service.
11. Contact
Security enquiries: [email protected]
General enquiries: [email protected]