Security4 min read

Security & Data Handling at GoNoGo

How GoNoGo protects your startup idea. Data encryption, session handling, privacy controls, and our no-storage policy explained.

GoNoGo Team

March 27, 2026

Your startup idea is valuable. Here's exactly how we protect it.

The Short Version

Ideas stored permanently

E2E

Encrypted sessions

GDPR

Compliant

SOC2

In progress

Our Data Principles

No Permanent Idea Storage

Voice sessions are processed in real-time and not recorded. Your idea description exists only during the active session.

Encrypted in Transit

All data between your browser and our servers is encrypted with TLS 1.3. WebSocket connections for voice use WSS (encrypted).

Reports Are Yours

Generated reports are stored in your account and can be deleted at any time. We don't use your data to train models.

No Third-Party Sharing

Your idea, reports, and session data are never shared with third parties, advertisers, or other users.

Infrastructure

Component	Provider	Region	Encryption
Voice processing	Google Gemini Live	US/EU	TLS 1.3 + WSS
Report storage	Firebase / Google Cloud	US	AES-256 at rest
Authentication	Firebase Auth	Global	OAuth 2.0 / Email
Payment processing	Polar (MoR)	EU	PCI DSS compliant
Web hosting	Vercel	Global CDN	TLS 1.3

What We Store vs. What We Don't

	Stored	Not Stored
Voice audio		Raw audio is never saved
Session transcripts	Optional (your choice)	Deleted if you choose
Generated reports	In your account
Your idea description		Not stored after session
Email & auth	Required for account
Payment info		Handled by Polar (MoR)

AI Model Usage

We use multiple AI models for cross-verification. Important details:

Your data is not used to train any AI models — we use API-only access

Sessions use Google Gemini, Anthropic Claude, and other models via API

Each model provider's enterprise API terms prohibit training on customer data

**Cross-model verification** means your data is sent to multiple AI providers for fact-checking. All providers are bound by enterprise API agreements that prohibit data retention and model training on customer inputs.

Your Rights

Access: Download all your data at any time from Settings

Delete: Remove your account and all associated data

Portability: Export reports as PDF

Consent: You choose what to store, what to delete

Compliance Roadmap

We're actively working toward formal certifications:

GDPR — Compliant (EU data handling, right to deletion, DPA available)

SOC 2 Type II — In progress, expected Q3 2026

HIPAA — Not applicable (we don't handle health data)

Questions?

Validate your idea in 30 minutes

Voice-first AI consulting team. 17 reports. Free to start.

Start Free →