Policy
Data Processing and Confidentiality
Last updated 02 Nov 2026
Corporate financial data is confidential. This page summarises the controls applied to data you upload to CostCubes.
Access control
- Each organisation can see only its own assessments, uploads, payments and reports. Every request is checked on the server.
- Analysts can open only the assessments assigned to them.
- Downloads of reports and source files use short-lived, signed links and are recorded in the audit log.
Storage
- Uploaded files are stored outside the public web folder and are never executed. Macro-enabled workbooks are rejected.
- Data is transmitted over HTTPS. Encryption at rest is provided at the storage / database layer of the hosting environment.
AI processing
Calculations and reconciliations run on our servers. Only with your organisation's consent are summarised metrics (not your raw files) sent to an external AI provider, and only for your own assessment.
Retention and deletion
On request, we export your data and delete it from active systems, subject to legal retention obligations. Contact the email address on our Contact page.