Where your data goes, in plain terms.
Altyzo is self-hosted, so your data is stored on your servers. It is not the whole story, and your clients' procurement teams will ask. This page is the whole story, including what we do not have yet.
Stored on your servers
The database, the search and analytics warehouse, the drafts, the review history and the backups all live on infrastructure you run. We do not host them.
Sent only to services you connect
The agents call the AI and data providers you set up with your own accounts and API keys. Content they work on is sent to those providers when it is processed. That is how any AI tool works, and it is why this page exists.
What Altyzo receives
Your license key, when the platform checks for updates. Pilots are different: they run on our server and are deleted at the end unless you buy. Ask us for the full list of calls to our servers before you sign; we will give it to you in writing.
Where each kind of data is stored and sent.
| What | Stored | Sent to |
|---|---|---|
| Client site content, keywords, drafts, review history | Your Postgres database and ClickHouse warehouse | The AI providers you configure with your own keys (OpenAI, Anthropic, OpenRouter) when the agents research, draft and analyze |
| Pages the agents fetch (client sites, competitors) | Your database | Firecrawl: its cloud service with your key, or a Firecrawl instance you run on your own server |
| AI-citation checks | Your database | Perplexity and the AI providers above, using your keys |
| Search Console and GA4 metrics (optional pipeline) | Your ClickHouse warehouse | Pulled from Google by the Airbyte pipeline, if you enable it |
| Approved content | Your database | Your client's CMS (WordPress, Shopify, Webflow) through its API, only when you publish |
| Dashboard sign-in | Your database | Google sign-in (OAuth) |
| License and updates | Your database | Altyzo's release server (your license key and a request for the latest signed release); container images come from the GitHub Container Registry |
Based on the current deployment configuration. Providers and services are the ones you choose to connect; their own terms apply to what they receive. Technical detail is on the security page.
- A deployment that runs inside your own perimeter, with no shared tenant
- Signed updates: release instructions and container images are signature-checked before anything is applied
- HTTPS only, TLS 1.2 and 1.3, standard security headers
- Database ports closed to the outside, and only the web proxy reachable
- Written answers to your security questionnaire
- No SOC 2 report
- No third-party penetration test
- One founder, no on-call team
- No public customer references yet (the pilot is how that changes)
If a client requires any of these from every vendor, tell us in the first call and we will say honestly whether we fit.
What procurement teams ask.
It is stored there, yes. It is not only there: when the agents process content, that content goes to the AI providers you connected, under your accounts and their terms. Treat those providers as sub-processors in your own client contracts. We can give you a one-page data-flow diagram to attach.