Security & Subprocessors
Last updated: September 11, 2026
This page states, plainly, what RefreshRadar's app registration can do inside your Power BI tenant, which outside companies (subprocessors) touch your data and why, and how long anything is kept.
What our app can do in your tenant
RefreshRadar's app registration holds the Contributor role on the workspaces you grant, with read-only behavior on your refresh metadata: every Power BI request we build is a GET. An audited, account-scoped call log records every request we make (with tokens redacted), viewable from your dashboard.
What you can choose to make public
Optional public status page (paid plans): you can publish, per tenant, a status page and badge at a secret link that shows each monitored dataset's workspace name, dataset name, current refresh state and last refresh time to anyone who has the link, with no sign-in. It is off by default and you switch it on per tenant. Disabling it, downgrading, or rotating the link takes effect on the next request; an already-embedded badge image can keep showing its last cached state for up to a minute. Error text, root-cause explanations and identifiers are never shown on it.
Subprocessors
The following companies handle data on our behalf in order to run RefreshRadar:
| Subprocessor | What it processes | Retention |
|---|---|---|
| Supabase | US-hosted Postgres database (your account, tenant, workspace, dataset, and refresh-event data) plus encrypted daily backups. | Backups age out within Supabase's 7-day backup-retention window; no PITR add-on is purchased. |
| Vercel | Application hosting and cookieless Web Analytics (no cross-site tracking). | Retained for the life of the deployment, under Vercel's standard hosting/analytics data handling. |
| Anthropic | AI failure-narrative generation: the classification input is the Power BI error code plus a small amount of surrounding context. Also, when you send a help request from inside the app and it mentions an error in our public catalog, the text of that message is sent to draft a suggested reply for the person who answers it; the draft is reviewed by a person and is never sent to you automatically. | Handled under Anthropic's standard API terms. We have not verified a special data-retention or training-exclusion agreement, so none is claimed here. |
| Resend | Transactional email delivery for alert notifications. | Retained per Resend's standard operational delivery-log retention. |
| Stripe | Billing and payment processing (subscriptions, invoices, the hosted Customer Portal). | Stripe retains transaction and tax records per its own legal and regulatory obligations, independent of your RefreshRadar account status. |
| Sentry | Error monitoring for application exceptions (expected 429 / transient-retry events are excluded and are never sent to Sentry). | Retained per Sentry's standard error-event retention window. |
| cron-job.org | External uptime/heartbeat monitoring of RefreshRadar's own polling service. | Retained per cron-job.org's standard monitoring-log retention. |
| Azure Key Vault | Secure storage of RefreshRadar's single multi-tenant application credential (the signing certificate). | Retained for the operational life of the credential; holds no customer data. |
Retention & deletion
Durable refresh history is retained while you are a customer (a paid feature; the free tier keeps 7 days of history). When you disconnect a tenant or close your account, your primary data is purged on offboard within days, with an audit entry recorded for the deletion. Residual copies in Supabase's encrypted daily backups age out within the 7-day backup-retention window, so every copy, primary and backup, is eliminated within 30 days.
Data Processing Addendum
Data Processing Addendum (DPA): a formal DPA isn't published yet, but you can request one and we'll provide it.
Questions
Email hello@refreshradar.com with any security or data-handling question.