Data handling
Your documents stay yours.
The documents behind a CDS position are confidential. Mastermind is built so that what you upload is private by default, visible only to the people you choose, never published unless you publish it yourself, and never used to train anything.
In one line each
Private by default
Only you, and people you choose, can open your cases.
Never public unless you publish it
Never listed publicly or shown to other customers, unless you publish a case yourself.
Never used for training
CDSBench trains no models on your documents or on anything else.
Deletable
Delete your account and your cases go with it. A case you made public stays public until you ask us to remove it.
Where your data goes
From upload to result
Four steps, encrypted in transit and at rest. The only outside party that sees any of your text is the AI model provider that runs the analysis.
- 1
Your browser
Your files travel to CDSBench over an encrypted connection.
- 2
CDSBench server
We parse your files into sections on our own servers. No outside document-conversion service is used.
- 3
Analysis
For long documents only the sections the analysis needs are sent, and short documents (under about 60,000 characters) are sent whole, encrypted, to our AI model provider (Anthropic) under our business account. It does not train on them and keeps them for up to 30 days under its own policy.
- 4
Your case
Your documents and results are stored encrypted, linked to your account and visible only to you and the people you choose.
Where your data is stored
In the EU, on Google Cloud in Belgium
Location
The CDSBench application and its database run on Google Cloud in region europe-west1, in Belgium, in the EU. Your cases, documents, results and account are stored there.
Encrypted in transit
Every connection between your browser and CDSBench uses TLS, and so do our connections to the providers listed below.
Encrypted at rest
Stored data is encrypted with Google-managed encryption keys. Google Cloud encrypts data at rest by default, using AES-256.
Sub-processors
Providers that handle your data
The outside companies that process data on our behalf, what each one is for and what it receives.
| Provider | What for | What data | Where |
|---|---|---|---|
| Google Cloud | Hosting and database | Everything stored in CDSBench: your account, cases, documents and results | EU: europe-west1, Belgium |
| Anthropic | AI analysis | The document text the analysis needs (for long documents only the relevant sections, short documents whole), with the case details and question. Not used for training; kept for up to 30 days under Anthropic’s policy | Anthropic’s infrastructure |
| Stripe | Payments, invoices and tax | Your billing details, entered on Stripe-hosted pages. Card details never reach CDSBench | Stripe’s infrastructure |
| Resend | Sign-in, account and newsletter email | Your email address and the content of each email | Resend’s infrastructure |
| Sign in with Google, if you use it | Google confirms your email address to us | Google’s infrastructure | |
| Google Analytics | Visit statistics, only if you accept cookies | A subset of site usage events, such as page views; never document text or case details | Google’s infrastructure |
Some of these providers are based in the United States; transfers are covered as the privacy notice describes. If you enter an EU VAT number at checkout, we check that number, and nothing else, against the European Commission’s VIES register to decide whether the reverse charge applies. The public-record sources we read for public cases and news receive no customer data. Privacy notice
Who can see a case
Only the people you choose
You
Every case is linked to your account. Opening it requires being logged in as you: a case link on its own gives no access, and knowing your email gives no access.
Your desk, if you set one up
On a Desk plan, the members you invite can see the desk’s cases and notes. Nobody else is added without your action, and you can remove members at any time.
People you send a link to
A case is shared outside your account only if you create a share link. Links expire, and you can revoke them at any time. There is no link until you make one.
What we never do
The lines we do not cross
- Publish your cases, list them or show them to other customers, unless you publish a case yourself.
- Add your documents to CDSBench's public cases or examples without your say.
- Use your cases to answer anyone else's questions.
- Train AI models on your documents.
- Put your documents or case details into analytics.
- Sell your data, or pass your documents to anyone other than the AI model provider that runs your analysis.
Your control
Keep it as long as you need, and delete it when you want
Retention
Cases are kept while you have an account, so you can add documents, re-run and compare revisions. Nothing expires without warning.
Deletion
Delete your account from Account settings. You confirm with a fresh code, and your cases, documents, notes, follows and alerts are removed with it. Only anonymous usage counts remain, plus invoices, which we keep as bookkeeping law requires. A case you made public stays public until you ask us to remove it.
Sign-in
No passwords to steal: you log in with a one-time code sent to your email, or with Google, and your session is kept secure.
The details
Analytics, payments and public sources
Analytics
We count visits and completed analyses to improve the product — never what your documents say. Google Analytics runs only if you accept cookies.
Payments
Payments go through Stripe, a leading payment provider. Your card details never reach CDSBench.
Public material
The public cases and news use public-record sources whose rights are checked per source. Data sources & rights
Certifications
Where we stand
CDSBench is not yet SOC 2 or ISO 27001 certified. Instead, this is what we do today:
- Hosting and database in the EU (Google Cloud, Belgium).
- Encryption in transit (TLS) and at rest (AES-256).
- Sign-in by one-time email code or Google. No passwords.
- Sign-in links are single-use; sign-in codes expire after 10 minutes and stop working after a few wrong guesses.
- Cases visible only to your account, your desk and share links you create.
- No training on your documents, by us or by our AI provider.
- CDSBench admin access limited to the founder.
- Breach notification as the GDPR requires.
Company and legal
Who is responsible for your data
Operator
CDSBench is operated by mrbooz AB, Sweden, and processes personal data under the EU GDPR. mrbooz AB is the data controller, and our terms are governed by Swedish law. For a security questionnaire or data processing questions, contact support@cdsbench.com.
If something goes wrong
If a personal data breach affects you, we notify you without undue delay, and we notify the Swedish Authority for Privacy Protection (IMY) within 72 hours where the GDPR requires it.
Responsible disclosure
Report a security issue
Where to send it
Email support@cdsbench.com with “Security” in the subject. We acknowledge your report within 2 business days.
What to include
What you found, the page or feature affected, the steps to reproduce it, and how we can reach you.
Please don’t
Access, change or delete anyone else’s data (test with your own account), or run tests that disrupt the service, such as load or denial-of-service tests, spam or social engineering.
Questions about your data?
Ask us before you upload anything. For a security questionnaire or data processing questions, contact support@cdsbench.com.