How Headroom handles your data
Headroom is early-stage software. This page states only the controls that exist today, marks the ones our providers run, and lists what isn't in place yet. The software recommends. The MSP decides.
This is the hosted service. Workspace data is stored by Supabase in its London region, in the United Kingdom.
Security
Access controls, isolation between workspaces, and the audit log.
- Sign-in uses Supabase Auth: email and password, or a one-time email link. The sign-up form requires a password of at least 10 characters, with upper and lower case letters and a number.Hosted service
- Two-factor sign-in is available to every account: a six-digit code from an authenticator app, set up with a QR code drawn in your browser. A workspace owner can require it of every member, and the database then shows that workspace only to sessions that entered a code.Hosted service
- Each member has one of four roles: owner, manager, finance or viewer. The database enforces what each role can change, through row-level security, as well as the screens hiding what a role cannot do. Viewers can read but change nothing.Hosted service
- Postgres row-level security is on for every table. Every row carries its workspace ID, and the database returns rows only to signed-in members of that workspace.Hosted service
- Links between records are keyed on the workspace as well as the record, so a row in one workspace can't point at a record in another. Signed-out visitors have no access to any table.Hosted service
- The isolation checks ship with the code (supabase/tests/rls.sql): reads, writes, deletes and cross-workspace references from a second account are all refused.Hosted service
- Contract files sit in a private storage bucket, in a folder only your workspace can read. It accepts PDF and plain text files up to 20 MB.Hosted service
- Analyses run on the server, after it checks that you are an owner or manager. Browsers can't write analysis results: every figure, piece of evidence, calculation and confidence level stored for an opportunity comes from the rules engine, and members can change only their decision on it. Analyses are limited per person and per workspace each hour and each day.Hosted service
- Key actions are written to an append-only audit log: uploads, analysis runs, opportunity decisions, exports and deletions. Team changes are logged too: invitations, joins, removals and role changes. Members can add entries but cannot edit or delete them. Entries hold IDs, counts and stage names, not client data.Hosted service
- The site is served over HTTPS only with HSTS, under an enforced Content Security Policy, and refuses to be framed by other sites.
- CSV exports neutralise cells that a spreadsheet would run as a formula.
Who can access your data
- Inside Headroom: only signed-in members of your workspace, with what each can change set by their role. The owner invites members and can change roles or remove members at any time.Hosted service
- Headroom's operators can technically reach stored data through the hosting provider's administration tools. That access is used only to run, secure and support the service, as the Terms set out.Hosted service
- Nobody can add themselves to another workspace: workspaces are created only through a database function that makes the creator its owner, and joining one needs an invitation from its owner. An invitation link works once, for the email address it was sent to, and expires after 7 days. Only a hash of the link is stored. Where invitation emails are set up, the link is emailed only to the address invited, once.Hosted service
If something goes wrong
- If we become aware of a personal data breach that affects you, we will tell you without undue delay, and report it to the ICO where the law requires.
Privacy
What is stored, why, and for how long. The full account is in the privacy policy.
| What | Why | Kept |
|---|---|---|
| Your name and email | To create your account and sign you in | Until you delete your account |
| The columns you map from each CSV | To run the analysis. The original CSV file is never uploaded. | Until you delete the file, clear your data or delete the workspace |
| Contract text and the PDF file | To check work against what each agreement covers | Until you delete the file, clear your data or delete the workspace |
| Analyses, opportunities, decisions, notes and reports | To show results and record what you decided | Until you delete the analysis, clear your data or delete the workspace |
| Invitations: the email address invited and the role | So the person invited can join with that role | Until the workspace is deleted. The link stops working once used, withdrawn or 7 days old. |
| Audit log entries (IDs, counts and stage names only) | A record of who did what, for you to check | Until you delete the workspace |
- Free workspaces with no activity for 12 months are deleted with everything in them. Every member sees a notice with the date in the app from 30 days before; reminder emails are not sent yet. Workspaces on a paid plan are not deleted for inactivity.Hosted service
- The hosted service keeps every analysis. The app shows the newest 1,000 audit log entries.Hosted service
- Headroom sets no advertising or analytics cookies. Product analytics, where switched on, carry no names, email addresses, file contents, opportunity titles or £ values.
- We do not sell data, use it for advertising, or use it to train AI models.
Data processing
For the data you upload, your MSP is the controller and Headroom is the processor. The data processing annex sets out the terms.
Subprocessors
| Provider | What it does | Data involved | Where |
|---|---|---|---|
| Supabase, Inc. | Sign-in, database, file storage, and the server functions that run the analysis and request AI explanations | Account data and all workspace data, including contract files | Stored in London, UK; the analysis function is requested in London too. A US company; the AI server function may run outside the UK. |
| Netlify, Inc. | Hosts the website and delivers it through its content delivery network | Request logs, including IP address and browser details. No workspace data. | Global edge network. A US company. |
| Anthropic, PBC | Writes an AI explanation of one opportunity, only when you ask | That opportunity and its evidence (see AI below) | United States |
| Email delivery provider | Sends sign-up confirmation and sign-in link emails | Your name and email address | To be confirmed. We will name it here. |
| Resend | Sends workspace invitation emails, when they are switched on | The invited person's email address, the inviting owner's email address and the workspace name | United States |
We will update this list before adding or replacing a subprocessor that handles the data you upload.
Infrastructure
Where Headroom runs and what our providers look after.
- The website is static files served by Netlify. It holds no workspace data.
- CSV files are read and contract PDF text is extracted in your browser. The analysis runs on the server, on your workspace's stored data, and the results are saved to your workspace.
- The database, sign-in and file storage run on Supabase in its London region.Hosted service
- Supabase encrypts stored data at rest. This is the provider's control, described in Supabase's security documentation.Provider control
- Data you delete can remain in any database backups our provider keeps, until they expire. The backup schedule is not yet stated here (see Not in place yet).Provider control
- Traffic between your browser and Headroom is encrypted with HTTPS.
AI
AI assists with interpretation. Financial calculations are deterministic.
What AI does
- Writes a plain-English explanation of one opportunity, when you click Explain.
- The explanation is labelled AI-assisted, with the model and the date it was written.
What AI doesn't do
- Find opportunities. Deterministic rules do that, and the same data always gives the same result.
- Produce, change or total any figure.
- Set a confidence level or a classification.
- Decide anything. Recommendations require MSP review before action.
What is sent, and the checks on what comes back
- Clicking Explain sends one opportunity to Anthropic's API from our server: the client name, the opportunity's title, description, value and recommended action, and its evidence, which can include ticket text, technician names and quoted contract sentences. This data is processed in the United States.Hosted service
- Nothing is sent unless you click. The API key stays on the server, and the request runs with your own sign-in, so the same access rules apply.
- Quotes are checked word for word against your evidence. An explanation that introduces a number not in your data, or words such as "owes" or "guaranteed", is rejected and not saved.
- Only the server can write the explanation. It is cleared when the opportunity it describes changes: its evidence, figures, wording or classification, or the client name.
- Explanations are limited per workspace each day, and per user each hour and each day.
- How Anthropic handles API data is set out in Anthropic's commercial terms.Provider control
Evidence and confidence
Confidence reflects the strength and completeness of the underlying evidence. These are the checks the engine applies to every opportunity.
| Level | Meaning |
|---|---|
| High confidence | Direct evidence in your records on both sides of the comparison, and a deterministic calculation with no defaulted inputs. A keyword match in ticket text is never enough on its own. |
| Medium confidence | Your records support it, but an input is assumed (a Settings price, rate or hours, or the clients file rather than the agreement), the link rests on a keyword match in ticket text, or a person needs to check something the data cannot show. |
| Low confidence | The evidence is incomplete or ambiguous, or the value is modelled rather than counted. |
How each rule earns High confidence
| Rule | High when | Otherwise |
|---|---|---|
| Out-of-scope work | Out-of-hours work only: the time entries fall outside the support hours stated in the agreement, no other wording says the work is included, and the rate comes from the agreement. Other kinds of work are linked to the ticket by a keyword match, so they are never High | Medium |
| Billable ticket, non-billable time | Never: the time may be a deliberate write-off | Medium |
| Chargeable-looking work | Never: nothing confirms it is chargeable | Low |
| Recurring charge below agreement | Contracted quantity stated in an agreement, and one unambiguous per-unit billing line | Medium |
| Missing recurring charge | Never: it may be bundled into another line | Low |
| Agreement drift | Contracted quantity from an agreement the clients file does not contradict, fewer billed than active, priced at one unambiguous billing line, every asset dated | Medium |
| Unbilled licences | Licence and billing line names identical | Medium |
| Usage over allowance | Never: invoices are not in the data, so the overage may already be billed | Medium or Low |
| Underpriced client | Never: the margin is a modelled estimate | Low |
Classification
| Classification | Meaning |
|---|---|
| Confirmed discrepancy | Two of your own records disagree, including what you bill, and the difference is calculated directly from them. It confirms the records disagree, not that money is owed. |
| Potential opportunity | The evidence supports it, but it needs your review before billing or contractual changes. |
| Investigation required | The evidence is incomplete, or the value is an estimate. |
Each opportunity shows its evidence, the file and row (or contract and section) each line came from, and its calculation. Only High confidence opportunities count towards the High confidence total; Medium and Low are shown separately as requiring review. No opportunity is presented as money a client owes.
Data deletion
What each control deletes, and what it doesn't. The controls are in Settings under Data and privacy, and on the Analyses page.
| Control | Deletes | Keeps |
|---|---|---|
| Delete a source file | The upload record, its stored file and the records imported from it | Clients that still have other records or opportunities you have decided on. Records imported before Headroom tracked which file each record came from (before 8 October 2026) stay; Clear all data removes them |
| Delete an analysis | That analysis run, its opportunities and its reports | Your data, other analyses and your tasks (unlinked) |
| Clear all data | Every client, upload, contract file, analysis, opportunity, task and report | Your account, workspace name, settings and audit log |
| Delete workspace | The workspace and everything in it, including the audit log | Your account |
| Delete account | Your account, your workspace and everything in it | Nothing in the app |
| Inactivity (free workspaces) | After 12 months with no activity: the workspace and everything in it, including stored files and the audit log. A notice shows in the app from 30 days before. | Your account. Workspaces on a paid plan are never deleted for inactivity |
- Each deletion asks you to confirm, and says what will go.
- Deleted data can remain in any backups our database provider keeps until they expire, and in provider request logs for the period they keep them. Backups are not used to restore deleted data except to recover from a fault.Provider control
- Before deleting, you can export opportunities as CSV and reports as PDF or CSV.
Security contact
Found a vulnerability, or worried about your data?
Email hello@headroommsp.com with what you found and how to reproduce it.
Please don't access or change other customers' data, or disrupt the service, while testing.
Not in place yet
So you can judge for yourself. None of these is claimed anywhere on the site.
- SOC 2 or ISO 27001 certification.
- An independent penetration test.
- Single sign-on (SAML or OIDC).
- Backup codes for two-factor sign-in. If you lose your authenticator, account recovery is by contacting us, and we verify you before removing it.
- Reminder emails before an inactive free workspace is deleted. Today the notice is shown in the app only.
- A published database backup schedule and retention window.
Headroom is a trading name of A-IT & Cyber Group Ltd, registered in England and Wales (company number 17473234). Registered office: 26 Balston Road, Poole, BH14 0QH.