How The Buy Signal handles your data, the documents you upload, and the NDAs you sign.
The Buy Signal is buyer-side analytical software. We process deal documents solely to help buyers evaluate potential acquisitions, the same purpose permitted under every standard broker NDA. We never sell or share your individual deal data. We may produce de-identified, aggregated market statistics, with an opt-out, designed so that no individual deal is identifiable. Documents are processed under strict data-handling terms with our AI provider, identifying information is stripped from persistently stored data, and original uploads are retained encrypted at rest, behind per-account access controls.
The Buy Signal is software you use to evaluate acquisitions. We are not a broker, marketplace, lender, or seller-facing service. We never sell or share your individual deal data. We may produce de-identified, aggregated market statistics, designed so that no individual deal, business, or person is identifiable, and you can opt out before any such use.
When you upload a document, we strip identifiers (business name, owner names, addresses, phone numbers, emails, and other identifying values) from the structured analysis before saving it to our database. The original values are encrypted with a key your administrator could not use to decrypt them at the database layer.
Original uploaded files (PDFs, DOCXs, etc.) are retained so analysis can be refined and you can re-review the source. They are encrypted at rest, locked to your account by row-level security, and only reachable through short-lived signed URLs. You can delete any document yourself at any time.
When you join The Buy Signal, you accept our Terms and Conditions, which include your representation that you have authority to disclose the documents you upload: a valid NDA carve-out for representatives, written broker consent, or that you accept full responsibility. We record that acceptance as an immutable audit record, and every document you upload is tied back to it.
Every AI request is made under per-request Zero Data Retention enforcement, and is routed only to model endpoints carrying contractual no-retention terms. The applicable API terms explicitly prohibit using that content for model training. Your deal documents do not become part of any model's knowledge.
Some of our guidance draws on a library of publicly published podcasts and books about small-business acquisition. We do not own, host, license, or republish any of that material, and we claim no copyright in it. Every word of it belongs to the people who made it. What we do is aggregate what experienced buyers and operators have already said in public, point you to the parts relevant to your deal, and direct you to the original to hear it for yourself.
A summary is a signpost, not a replacement. It cannot carry the caveats, the tone, or the follow-up question the host asked next. We design for the click-through, not against it.
These shows are free, and their creators earn nothing when someone reads a summary of their work instead of hearing it. We tell our users to subscribe to them, follow them, and buy their books. This library only exists because they published first.
The full list of what we cover, with a link to every show, is on the Podcast Library page inside the app. If you make one of these shows and would like it credited differently, added, or removed, email trust@thebuysignal.com and we will act on it.
When a broker asks you to sign an NDA, you can attach our NDA Addendum to expressly include analytical SaaS tools in the agreement's definition of permitted Representatives. The addendum is short, professional, and ready for the broker to countersign.
Download NDA Addendum (PDF)We use third-party services in the categories below to operate The Buy Signal, all of them bound by contract to the data-handling commitments described above. We list them by category rather than by vendor. Customers who need the named sub-processor list receive it under a signed DPA.
| Service | Purpose | Region |
|---|---|---|
Models We use a multitude of foundation models, every one of them accessed under Zero Data Retention (ZDR) enforcement. No prompt or document content is retained beyond the lifetime of the request, and the applicable API terms prohibit using that content for model training. We also run models against one another to check accuracy: a second model reads the same document independently, and figures the two readings disagree on are flagged rather than quietly averaged. Every model we use is built and operated by a United States company, and we do not route customer documents to foreign-hosted models. | Document reading, deal scoring, and Signal Report narrative | United States |
Database SOC 2 Type II certified infrastructure. AES-256 at rest, and TLS 1.3 in transit, the current internet encryption standard, which is forward-secret: intercepted traffic stays unreadable even if a key is compromised later. Row-level security isolates each customer's data so that no account can read another's, even with valid credentials. | Authentication, application data, and encrypted file storage | United States |
Servers TLS 1.3 in transit, forward-secret so captured traffic cannot be decrypted after the fact. Process isolation between deployments. No customer documents are stored on application servers. | Application hosting | United States |
The controls below describe how the commitments above are enforced. We state them by control rather than by vendor or implementation.
Customers who require a signed DPA (typically: funds, family offices, search funders with LPs) can request our standard DPA below. It names each sub-processor individually and incorporates their data-handling terms, including the no-retention terms covering every model endpoint we use.
Email trust@thebuysignal.com to request the DPA.