You are about to hand over your accounts, your board pack and your growth numbers. Asking what happens to them is not paranoia. It is due diligence. Here is the plain answer.
Where it runs. Pixie runs on Google Cloud, infrastructure used by banks, governments and large enterprises, and is built with Zazmic, a Google Cloud Premier Partner. Your data is hosted on infrastructure that meets UK and EU data residency requirements.
ISO 27001. This is the international standard for managing information security. Pixie's processes are aligned with it through Zazmic. Aligned is the precise word: it is not the same as certified, and we do not claim certification. We are also working toward Cyber Essentials Plus, a UK government-backed cybersecurity certification.
Inside the platform. Everyone, staff included, can reach only the data they need. Two-factor authentication is mandatory and Pixie stores as little personal data as it can. The platform is tested through internal security reviews, external audits and ongoing penetration testing, where specialists try to break in so that weak points are found and fixed first.
UK GDPR. This is the UK's data protection law. It sets the minimum, and Pixie treats it as the minimum. Your data is used to produce your score and reports, to improve Pixie's benchmarks and methodology, and to keep the service secure. It is never sold. Data you upload is never used to train public or third-party AI models. Pixie shares data only with the providers needed to run the service, such as cloud hosting and payment processors. And it stays yours: ask at hello@heypixie.ai for a full copy, or to have it deleted.
The full detail is on our security page and in our privacy policy.