Architecture · Last updated September 29, 2026

Your data flow,
in plain English.

Your files are never uploaded, and every calculation runs in your browser. The AI plans the steps from your question, your column names and a small sample of rows. This page documents exactly what stays local, what is sent to the AI, and how you can verify it yourself in 30 seconds.

The data flow↓·Verify it yourself↓·For IT teams↓

The diagram

Here's exactly what happens when you use it.

━

Solid green = stays in your browser

- - -

Dashed amber = crosses to OpenAI

✓

Prompt, columns and a small sample cross — never the full file

The precise breakdown

No marketing language. Here it is.

Stays in your browser

The file itself
Files you drop in are never uploaded. They live in your browser's memory only and are cleared on page refresh.
Your full dataset
The AI never receives your whole file — at most a few sample rows (see the list on the right).
The calculation
Every step of your workflow runs in DuckDB-WASM in your browser. Totals, joins, pivots and intermediate tables are computed locally.
Re-runs
Re-running a saved workflow on new data is pure local SQL — no AI call at all.

Sent to OpenAI

Your prompt and the conversation
The question you ask. Treat it like a ChatGPT prompt — don't paste sensitive content into it.
Column names and types
Of each file and each workflow step, so the AI knows what fields exist. If a header itself is sensitive, rename it first.
Up to 3 sample rows per file
So the AI understands formats — dates, codes, signs. If the first rows of a file are sensitive, remove or mask them first.
The final summary table, for commentary
After a financial analysis runs, the result table (up to 60 rows) is sent so the AI can write a short explanation. Every figure it writes is checked against the table.
Small helper requests
Chart suggestions (a few sample values and numeric ranges per column), Excel header detection (the top ~20 rows with every number masked), and fixing a failed step (the SQL, the error and column names).
QuickBooks company details
When connected: company name, country and chart-of-accounts names, to plan the analysis.

Important practical note: The header row and the first few rows of each file are what the AI sees. If they are sensitive — for example, columns named patient_ssn or salary_jane_doe, or a top row with a real client's name — rename or remove them before analyzing. Generic names (id, amount, date) are always safe.

Third parties

Who else sees what.

Every service we use, what they see, and why. Standard SaaS infrastructure — no data brokers, no ad networks, no resale.

Service	Purpose	What they see	Retention
OpenAI (gpt-5.5)	Workflow planning	Your prompt, column names, up to 3 sample rows per file, and the summary tables and helper requests listed above	Per OpenAI's API terms — not used for training
Intuit (QuickBooks Online)	Accounting data — when you connect	Read-only access you grant: Profit & Loss, General Ledger, company info	Financial data not stored on our servers; OAuth token stored server-side, deleted on disconnect
Clerk	Account / authentication	Email, name, login events, session metadata	Standard auth records — see Clerk's privacy policy
Stripe	Billing (when subscribed)	Email, billing details, charge history	PCI-compliant; per Stripe's privacy policy
PostHog	Product analytics	Anonymized page views, click events, performance metrics	No file data — UI events only
Render	Hosting infrastructure	Access logs (IP, route, timestamp); AI requests and QuickBooks reports pass through our server to fulfill your request	Rolling log retention; your files are never uploaded here

View "what they see" details (mobile)

OpenAI (gpt-5.5)

Your prompt, column names, up to 3 sample rows per file, and the summary tables and helper requests listed above

Per OpenAI's API terms — not used for training

Intuit (QuickBooks Online)

Read-only access you grant: Profit & Loss, General Ledger, company info

Financial data not stored on our servers; OAuth token stored server-side, deleted on disconnect

Clerk

Email, name, login events, session metadata

Standard auth records — see Clerk's privacy policy

Stripe

Email, billing details, charge history

PCI-compliant; per Stripe's privacy policy

PostHog

Anonymized page views, click events, performance metrics

No file data — UI events only

Render

Access logs (IP, route, timestamp); AI requests and QuickBooks reports pass through our server to fulfill your request

Rolling log retention; your files are never uploaded here

What we do NOT do

Four things we never do with your data.

Each one is verifiable by inspecting the architecture or our agreements.

Store your file content

Your files are never uploaded. There is no database or storage bucket holding the rows of the spreadsheets you analyze. Saved workflows store the steps (SQL), the layout and data-source recipes — not your file data.

Train models on your data

What we send to OpenAI (prompt, column names, a few sample rows, summary tables for commentary) is processed under their API terms, which exclude training.

Sell or share your data

We have no data to sell. The only personal info we hold is your account email (via Clerk) and billing info (via Stripe). Neither is sold to anyone.

Log prompt content beyond debugging

Server logs capture prompt text only for short-window error diagnosis. Long-term logs strip prompt content.

Verify it yourself

30 seconds. Browser DevTools. Done.

Don't trust the marketing. Trust the network tab.

1
Open the canvas at gptbeyond.com/try
Use any browser that has DevTools (Chrome, Firefox, Edge, Safari).
2
Press F12 to open DevTools
Cmd+Opt+I on Mac. Click the "Network" tab.
3
Clear the log, then drop a file
Click the 🚫 icon in the Network tab to clear. Drop your CSV/Excel onto the upload zone.
4
Watch the Network tab as you drop
Result: nothing new appears in the log. The file load is purely client-side — no upload request.
5
Ask a question in the prompt
When you submit, you'll see a POST request to /api/chat. Click it.
6
Inspect the request payload
In the request body you'll see your prompt, the column metadata and up to 3 sample rows per file, sent to our server (which then calls OpenAI). You will NOT see the rest of your file.
7
Check the response
The response contains the SQL the AI wrote — referencing column names but not values. The actual workflow execution happens after this, locally in DuckDB-WASM.

Pro tip: Put an obviously-unique string like ZZZZZ-UNIQUE-MARKER-1234 in a row further down the file (below the first few, which are shared as samples). Then search the entire Network log for that string. If it's not there, your row data is genuinely staying local.

For IT teams

Reviewing this for company use?

Short version for IT review and DLP/whitelisting decisions. Pass this URL to your security team.

Does this product upload company files to a third-party server?

No. Files are never uploaded; all calculation runs in the user's browser. To plan the workflow, the AI receives the prompt, column metadata and up to 3 sample rows per file. After a financial analysis, the final summary table may be sent so the AI can write commentary.

What data crosses the network boundary?

The prompt, column names and types, up to 3 sample rows per file, the generated SQL, summary tables for commentary, and small helper requests (chart suggestions, header detection with numbers masked, step fixes). Never the full file. QuickBooks reports pass through our server on their way to the browser and are not stored.

How is data processed?

Client-side via DuckDB-WASM (an in-browser SQL engine, ~10MB Wasm binary). All workflow execution runs in the user's browser tab.

Are there compliance certifications?

Not yet — we're a small team. We can demonstrate the architecture above on request, which is the strongest possible posture for HIPAA / SOC 2 / GDPR data-flow questions.

Can we restrict this to certain users?

Today: paid via individual credit card, no SSO or org-level controls. Enterprise team plan with SSO + admin controls in our roadmap.

QuickBooks / Intuit connection

One important exception to "stays in your browser." The guarantee above applies to files you upload. When you connect QuickBooks Online, it works differently: the connection uses server-side OAuth, and your financial reports are retrieved by our server from Intuit's API, then delivered to your browser for local analysis.

What we access: read-only — Profit & Loss, General Ledger, and company information. We never write to your QuickBooks.
Where it goes: Intuit → our server (only to fulfill your request; not stored in any database) → your browser, where it's analyzed locally in DuckDB-WASM.
AI features: as with uploaded files, your prompt, column labels and a few sample rows are sent to OpenAI to plan the analysis, along with your company name, country and account names. After an analysis runs, the final summary table may be sent so the AI can write commentary (API terms — not used for training).
Connection token: stored server-side in an encrypted session cookie and deleted when you disconnect. You can also revoke access from within QuickBooks at any time.
Never sold or shared beyond the processors listed above.

This page is GPTBeyond's Privacy Policy and data-flow documentation — what data the Service handles, where it flows, the third parties involved, and how the QuickBooks connection works. We update it as the product changes.

For privacy questions, or data-access / deletion requests under GDPR or CCPA, email vibe@stoxgpt.com.