Built so a PMO can say yes
Steering-committee charts contain sensitive program information. This page documents exactly how GANTT360° stores, protects and processes your data — written for the person who has to clear us with InfoSec.
Built on SOC 2 Type II certified infrastructure — Supabase, Vercel and Stripe are independently audited. Details in the SOC 2 & compliance section below.
Data residency & encryption
Your charts, projects and account data live in a dedicated PostgreSQL database hosted by Supabase in AWS eu-west-1 (Ireland, EU) — at rest they never leave the EU. All traffic is encrypted in transit (TLS 1.2+) and data is encrypted at rest (AES-256). The application itself is delivered through Vercel's global edge network for fast load times worldwide.
SOC 2 & compliance
Every layer your data touches is SOC 2 Type II certified: Supabase (database & auth), Vercel (hosting) and Stripe (payments) are all independently audited. GANTT360° itself does not yet hold its own SOC 2 attestation — as a lean single-purpose tool we inherit our providers' certified controls and add GDPR compliance, EU data residency and a signed DPA for business customers on request. If your procurement needs vendor documentation, email office@botforce.at.
Access & workspace isolation
Authentication runs on Supabase Auth (email + password). Every database query is guarded by row-level security: your workspace data is isolated at the database layer, not just in application code. There are no shared workspaces and no cross-tenant access paths — GANTT360° is deliberately single-seat.
AI features & your data
AI features (PM Advisor, What-If, status reports) send your chart data to the Claude API only when you actively invoke them — never in the background. Per Anthropic's API terms, data submitted via the API is not used to train AI models. We store the AI's answers with your chart; we never sell or share your data.
Payments
All payments are processed by Stripe. Your card details never touch our servers — we store only the Stripe customer reference and subscription status. Cancel anytime; no long-term contracts.
Backups & version history
The database is backed up daily with point-in-time recovery. On top of that, every chart carries its own immutable version history — each auto-save is an append-only version you can restore with one click. Versions are never overwritten or deleted.
GDPR & data deletion
BOTFORCE GmbH (Vienna, Austria) is the data controller — see the Impressum and Privacy Policy. Deleting your account permanently removes your profile, workspaces, projects, charts and all versions. A data-processing agreement (DPA) for business customers is available on request.
Reporting a vulnerability
Found a security issue? Email office@botforce.at — reports go straight to the founder and are answered within 48 hours. Please give us reasonable time to fix an issue before public disclosure.
Subprocessors
The services GANTT360° relies on, what they do, and where they process data.
Last reviewed: August 2026. Questions? office@botforce.at
Built in Vienna by BOTFORCE
GANTT360° is made by BOTFORCE GmbH, a Vienna-based software company — founder-run, which means the person who answers office@botforce.at is the person who built the product. Company details in the Impressum.