Security

At Resultory, operated by EdenTouch CoLab Ltd, we take the security of your data seriously. This page describes the security measures we have in place, our approach to data protection, and what you can do to keep your account secure.

We are an early-stage product, and we believe in being honest about what we can and cannot guarantee. This page reflects our current security practices — not aspirational claims.

2.1 Account authentication:

We offer three authentication methods:

• Email and password
• Google Sign-In (OAuth 2.0)
• Microsoft Sign-In (OAuth 2.0)

For email and password authentication, passwords are handled by our platform provider's secure authentication system. We do not store passwords in plain text.

For Google and Microsoft Sign-In, authentication is handled entirely by the respective provider via OAuth 2.0. We never receive or store your Google or Microsoft password. We receive only your email address and basic profile information after you explicitly authorise it.

2.2 Account access:

• Each user has their own account. Data is scoped to your account.
• We do not share your venture data, hypotheses, evidence, or learning reports with other users unless you explicitly share a report or link.
• Account deletion requests are processed within 30 days of verification.

2.3 Platform access controls:

• Access to user data is restricted to authorised personnel who need it to operate and maintain the platform.
• Internal access is logged and reviewed.

3.1 Data storage:

Your data is stored by our cloud infrastructure provider. We do not own or operate our own physical servers.

3.2 Data isolation:

Each user's data is associated with their authenticated account. We do not expose user data to other users. However, we are an early-stage product and have not yet undergone independent security certification. We do not claim compliance with ISO 27001, SOC 2, or similar standards unless and until we achieve them.

3.3 What we do not claim:

We do not claim:

• Military-grade encryption (we have not specified our encryption standards publicly as they depend on our infrastructure provider)
• Zero-knowledge architecture (we process your data to provide the service)
• Immutable or tamper-proof records
• Independently audited security (not yet — we plan to pursue this as we scale)

We believe in stating what is true, not what sounds reassuring.

Resultory uses AI to process your venture data and generate customer hypotheses, segment comparisons, and learning reports. Here is how we handle that:

• Your venture data (product descriptions, assumptions, evidence) is processed by AI to generate recommendations
• AI-generated outputs are recommendations, not automated decisions — a human (you) reviews and approves every action
• We do not use your personal data to train external AI models
• AI processing happens within our platform infrastructure — we do not send your data to unmanaged third-party AI services for training purposes
• You can delete your data and AI-generated outputs at any time by deleting your account

5.1 Protect your account:

• Use a strong, unique password if using email authentication
• Enable two-factor authentication on your Google or Microsoft account if using those sign-in methods
• Do not share your account credentials with anyone
• Log out when using shared devices

5.2 Be cautious with links:

• Do not click suspicious links in emails claiming to be from Resultory
• Verify any email claiming to be from us by checking the sender address — we only send from @edentouchcolab.com domains
• Report suspicious emails to support@edentouchcolab.com

5.3 Review third-party access:

• Periodically review which third-party apps have access to your Google or Microsoft account
• Revoke Resultory access if you no longer use the platform (see Privacy Policy for instructions)

If we become aware of a security breach affecting your data, we will:

• 1. Investigate and contain the incident
• 2. Assess the scope and impact
• 3. Notify affected users without undue delay
• 4. Report to the ICO (Information Commissioner's Office) where required by UK GDPR
• 5. Take corrective action to prevent recurrence

If you believe you have found a security vulnerability in Resultory, we welcome responsible disclosure. Please do not publicly disclose the issue until we have had the opportunity to investigate and address it.

Report security concerns to: support@edentouchcolab.com (use subject line: Security Report)

We will acknowledge receipt within 48 hours and provide an initial assessment within 5 business days.

We are committed to improving our security as we grow. This page will be updated as we implement new measures, undergo audits, or adopt new standards. We will not claim certifications or guarantees we have not earned.

For security questions or reports:

• Email: support@edentouchcolab.com (use subject line: Security)
• Company: EdenTouch CoLab Ltd (Co No 16472666, ICO ZC047648)

Last updated: August 2026