Security & Compliance
This page describes TalkingSchema's data handling practices, security architecture, compliance posture, and contact information for security reports.
What Data TalkingSchema Stores
Schema structure only — not your database content
TalkingSchema stores the structure of your database schema: table names, column names, data types, relationships, and constraint definitions. TalkingSchema does not store, access, or transmit the actual data in your database tables — no row data, no cell values, no query results.
When you import a schema via Import → Connect to Database, TalkingSchema reads only the information schema (table and column metadata) from your connected database. It does not read any table rows.
What is stored per user account
For authenticated users, TalkingSchema stores:
- Your account information (email, name)
- Your schema threads: the schema structure, conversation history, and ERD layout state for each thread
- Export history (metadata only — what format was exported and when)
Schema threads are private to your account by default. They are not visible to other users unless you explicitly create a public share link.
What is stored for anonymous users
Anonymous users (not signed in) can use TalkingSchema with a session-based anonymous token. Anonymous session data is stored temporarily and may be purged after a period of inactivity. To ensure your schemas are preserved, create a free account.
Authentication and Session Security
TalkingSchema uses JWT-based authentication with secure session management:
- JWTs are short-lived — access tokens expire and are automatically refreshed to limit the window of a stolen token being usable
- Refresh tokens are stored in HTTP-only cookies (not accessible via JavaScript)
- Session management includes proactive token refresh on tab focus and before expiry, preventing expired-token states during active use
- No credentials are stored in browser localStorage — only tokens and session metadata are stored, never passwords
Passwords are hashed with a modern cryptographic hashing algorithm (bcrypt with a sufficient work factor). TalkingSchema does not store plaintext passwords.
Public Share Links
Public share links allow you to share a read-only view of a schema ERD with anyone — no TalkingSchema account required.
- Share links are opt-in — they must be explicitly created; schemas are private by default
- Share links can be revoked — deleting the public share link immediately removes access for anyone holding it
- Shared views are read-only — visitors cannot modify the schema, access your account, or view other threads
- The share link URL does not expose your account or thread ID — it uses a separate public token
Subprocessors
TalkingSchema uses a limited set of subprocessors for infrastructure and AI functionality. All subprocessors are evaluated for compliance with SOC 2 Type II, GDPR, and CCPA requirements.
| Subprocessor | Purpose | Compliance |
|---|---|---|
| Vercel | Frontend hosting and CDN | SOC 2, GDPR |
| Railway | Backend API hosting | SOC 2 |
| Supabase | PostgreSQL database (user data, threads) | SOC 2, GDPR, CCPA |
| OpenAI / Anthropic | AI language model inference | SOC 2, GDPR, CCPA |
| Mixpanel | Product analytics (anonymized events) | GDPR, CCPA |
| Sentry | Error tracking and diagnostics | SOC 2, GDPR |
TalkingSchema does not sell or share personal data with third parties for advertising purposes.
GDPR (European Union)
TalkingSchema is committed to GDPR compliance for users in the European Union and European Economic Area.
Your rights under GDPR
- Right of access — you can request a copy of all personal data we hold about you
- Right to rectification — you can correct inaccurate personal data
- Right to erasure ("right to be forgotten") — you can request deletion of all personal data and schema data (see "Data Deletion" below)
- Right to data portability — you can request your schema data in a portable format (JSON or SQL export)
- Right to object — you can object to processing for analytics purposes
Data residency
EU data residency options (hosting all user data within EU infrastructure) are available on request for Pro and Enterprise plans. Contact support@talkingschema.com to request EU data residency.
Legal basis for processing
TalkingSchema processes personal data under the following legal bases:
- Contract performance — processing necessary to provide the TalkingSchema service you have signed up for
- Legitimate interests — product analytics and error monitoring to improve service quality
- Consent — marketing communications (you can opt out at any time)
CCPA (California)
TalkingSchema complies with the California Consumer Privacy Act (CCPA) for California residents.
Your rights under CCPA
- Right to know — you can request information about the personal data we collect, use, and share
- Right to delete — California residents can request deletion of personal information (see "Data Deletion" below)
- Right to opt out of sale — TalkingSchema does not sell personal information; there is no sale to opt out of
- Right to non-discrimination — exercising your CCPA rights will not result in reduced service quality or pricing
To exercise your CCPA rights, contact support@talkingschema.com with the subject line "CCPA Request."
Data Deletion
You can request deletion of all your personal data and schema data at any time.
Self-service deletion: Account deletion is available from your account settings page. Deleting your account triggers permanent deletion of:
- Your account profile and credentials
- All schema threads and conversation history
- All public share links associated with your account
- All session and token data
Deletion is propagated to all internal systems and external subprocessors within 30 days, consistent with GDPR Article 17 requirements.
To request deletion by email: Contact support@talkingschema.com with the subject line "Data Deletion Request." Include the email address associated with your account.
Security Practices
Encryption
- In transit: All data transmitted between clients and TalkingSchema servers is encrypted with TLS 1.2 or higher. HTTPS is enforced on all endpoints.
- At rest: Database contents are encrypted at rest using the encryption capabilities of the underlying cloud infrastructure (Supabase on AWS).
Access controls
- TalkingSchema engineers access production systems only when required for incident response or maintenance, with access logged and audited.
- Database access is restricted by IP allowlist and requires multi-factor authentication.
- No engineer can access user schema content in the normal course of operations.
Vulnerability disclosure
TalkingSchema practices responsible disclosure. If you discover a security vulnerability in TalkingSchema, please report it to security@talkingschema.com. We will acknowledge your report within 48 hours and work with you on a coordinated disclosure timeline.
Do not publicly disclose vulnerabilities before we have had an opportunity to investigate and remediate.
Dependency and supply chain security
TalkingSchema monitors dependencies for known vulnerabilities using automated scanning. Security patches are applied promptly. We review third-party code and AI model providers for security practices before integrating them into the stack.
AI Model Data Handling
TalkingSchema uses large language model APIs (OpenAI, Anthropic) for AI schema generation. The following data is sent to the AI model during schema design:
- Your conversation messages (prompts and AI responses)
- The current schema structure (table/column/relationship descriptions)
Your schema structure is not used to train AI models. TalkingSchema uses API-access-only model configurations, not training-feedback endpoints.
Schema content submitted to AI models is governed by the respective providers' API data processing agreements (OpenAI's and Anthropic's), which prohibit use of API content for model training by default.
Contact
For security reports and vulnerability disclosures: security@talkingschema.com
For privacy and compliance inquiries (GDPR, CCPA): support@talkingschema.com
For general support: support@talkingschema.com