Your rows stay with Evident.
Evident computes every number itself, from your rows, on its own servers. An AI model reads your request and writes up the results. It never sees your rows, with one exception you control at setup.
This page is for the person who has to approve an upload: what is stored and where, what the AI model is shown at each step, what the provider keeps, how deletion works, and the options for stricter needs. It describes Evident as of its October 2026 release. Items marked on request are arranged per client.
The one idea, stage by stage
No row crosses the line between the two columns, except the setup sample you allow. That gate is yours.
No row crosses this line, except the setup sample you allow. That gate is yours.
Evident keeps its own record of what it sent, in your workspace's database and run files. Values from your data do reach the model as category names (a region, a product, a store: up to 50 per breakdown) and as computed totals. Those are the two things it needs to write about your results.
Every call to the model
All calls go through one adapter to OpenAI's business API, each made with OpenAI's storing switched off. No other model, no embeddings, no web search.
| When | Calls | What is sent | Not sent |
|---|---|---|---|
| Dataset setup (the definitions draft) | 1 | The file name; row and column counts. For each column: name, type, share of blanks, number of distinct values, and the code's own flags ("looks like a date"). Your choice: up to 10 example values per column and up to 10 example rows, spread over the table, personal-looking columns masked; or names and counts only. Your notes. | The file; the other rows; the profile's ranges and top values |
| The Brief (create, reply, update) | 1 per turn | The request and your replies. The dataset's title and summary. Metric names, synonyms and formulas; breakdown names. Member names of each breakdown with 50 members or fewer; a personal breakdown sends only its count. The date range, grain and calendar. On later turns, the current Brief. | Rows, figures |
| Make the plan (the Questions) | 1 | The request; the Brief's summary, outcomes and view labels. | Rows, figures |
| The run: computing | 0 | Nothing. Every calculation runs on Evident's servers. | |
| The run: choosing findings | 1 per Question | The Question; tables of its computed results: totals, changes, shares and ranks by member. | Rows |
| The run: writing | 1 per Question, 1 for the Story | The chosen findings with their figures. | Rows |
| Ask (the assistant) | 1 per question | Your question and up to 10 earlier turns; the matching Help pages; the page you are on; if you choose one, a dataset's definitions (a personal column is named, its values never listed). The words of your question are not stored. | Rows, results |
| A deck you ask for (the Story's own deck needs none) | 1 to make it, 1 per re-planned slide | The request and audience; the run's findings and figures, with personal member names masked. | Rows |
| Reading the results (the Story, Questions, Context, Check) | 0 | Nothing. Code only. |
Where it runs, who sees it, how it is kept
Where it runs, and who signs in
- Amazon Web Services, Ohio, United States. One server runs the app; a managed PostgreSQL database and a storage bucket sit beside it, in the same region. in place
- Behind Cloudflare: the server has no public address. Every request comes through an encrypted tunnel, after sign-in. in place
- Each person signs in with their own email, by a one-time code. The app checks the signed sign-in token on every request. in place
- Single sign-on with your identity provider (Microsoft Entra ID, Okta, Google, SAML or OIDC), and with it your two-step login rule. A setup on our side; no change for your people. on request
Who sees what
- Each client is its own organization, with one or more workspaces. Every table in the database carries the workspace, and the database refuses to show one workspace's rows to another: row-level security, not only a rule in the app. in place
- Within a workspace, people have roles. Seeing a dataset's rows needs its own right, "Can see rows". Columns marked personal stay hidden until someone with that right shows them. in place
- Every viewing of rows, and every change, is recorded. in place
- At PhasePoint, one named administrator can reach production, for operating the service. Sign-ins to Evident and actions in the cloud console are logged. in place
How it is stored
- The database holds definitions, analyses, results and Stories. The bucket holds the files and rows, under each workspace's own folder, each file checked against its fingerprint when read. in place
- Encrypted in transit: HTTPS from your browser to Cloudflare, an encrypted tunnel from Cloudflare to our server, and encrypted connections from our server to the database, the storage and the AI provider. in place
- Encrypted at rest by AWS: the database and the file storage. in place
- Backups: the database is backed up automatically every day and can be restored to any point in the last 7 days. in place
Deleting
- Delete a dataset, a table, a version or a run from the app. A preview lists exactly what will go first; for a dataset, its versions and every analysis and run that uses it. Its stored files go in a full removal. in place
- The uploaded file, as it came, is removed from storage after 30 days; Evident keeps the rows it read from it. in place
- Full removal of everything you sent us, including stored files, history and backups. on request
The AI provider
- Evident uses OpenAI through its business API. OpenAI does not train its models on API data. in place
- Every call is made with OpenAI's storing switched off, so OpenAI keeps no copy of the conversation to view. in place
- OpenAI may keep content for up to 30 days in its abuse-monitoring logs. Zero data retention removes that; it is arranged with OpenAI per organization. on request
- Where OpenAI processes a call is not fixed without a data-residency arrangement with them. on request
What the model is for. It never computes a number; code does, from your rows. It chooses which computed findings matter and writes them up, inside guards. Every number it words is checked against the computed fact before you see it, and matched to it again when the results are read. Anything that fails is dropped.
For stricter needs
- Names and counts only. Set as your organization's or workspace's default in Settings, or chosen when a dataset is set up, so setup sends no example values or rows. The model then never sees a row at any step. The suggested column labels and units are a little weaker, and you fix them in review. in place
- Your own Azure OpenAI. Model calls run in your Microsoft tenant, under your agreement with Microsoft. Set up for a dedicated installation. on request
- Evident in your own cloud account. The three services, your database and your storage bucket, in your AWS account, so the data never leaves your network. A project we do with you, with an install guide and tested backups, not a switch. on request
- Single sign-on and two-step login. Your identity provider in front of Evident, with your multi-factor rule. on request
Questions people ask
Does any of our raw data reach an AI model?
Not your rows, except a sample of up to 10 at setup if you allow it, with personal-looking columns hidden. Choose names and counts only and no row is ever sent. The model does see the names of your categories (up to 50 per breakdown) and the totals Evident has computed; it needs those to write about your results.
Is the model doing the maths?
No. Every number is computed by code from your rows, on Evident's servers. The model chooses which computed findings to mention and words them, and each number it words is checked against the computed fact before you see it.
Does OpenAI keep or learn from what Evident sends?
It does not train on API data. Every call is made with storing switched off. It may keep content up to 30 days for abuse monitoring; zero retention can be arranged for your organization.
Who at PhasePoint can see our data?
One named administrator, for operating the service. Sign-ins and cloud-console actions are logged. Inside the app, your organization is not visible to PhasePoint's own organization.
Can we delete everything?
Datasets, tables, versions and runs can be deleted from the app at once, with a preview of what will go. Full removal of stored files, history and backups is done on request.
Can Evident run in our own environment?
Yes, as a project: the services run in your AWS account with your database and bucket, and model calls can go to your own Azure OpenAI. Talk to us about scope.
Are you certified?
Evident does not claim a certification at this release. This page describes what is in place and what is arranged per client; we are glad to answer a security questionnaire.