Last updated September 13, 2026
Product Map Ltd, doing business as Product Map ("we," "us," or "our"), uses this Security Policy to describe how information processed through Product Map and related services (the "Services") is protected. The Services include https://www.productmap.io and https://app.productmap.io.
Product Map is an AI-powered product management platform. Users bring product context, optional third-party integrations, and AI agents together to support day-to-day product work. This document explains storage and processing locations, the controls we apply, how subprocessors are involved, and how to raise a security concern.
Treat this Security Policy together with our Privacy Policy and Terms of Use. Privacy rights, retention rules, and legal roles described in those documents also apply here.
Security questions? Write to [email protected]. Vulnerability management and suspected incidents are covered in Sections 12 and 15.
These highlights flag the main practices in this policy. Full detail sits in the table of contents below.
Where is data stored and processed? Account data, Content, integration credentials, and related service data live on Product Map infrastructure run through our cloud hosting provider. AI providers and other subprocessors named here and in the Privacy Policy also process some of that data. Detail is in Sections 2 and 3.
Do you offer data residency options? No. A customer cannot select a geographic region for stored data. Detail is in Section 4.
How do you connect to third-party tools? Optional integrations use industry-standard OAuth 2.0 (three-legged OAuth). Passwords, personal access tokens, and other shared secrets are not requested for those connections. Detail is in Section 6.
How is data encrypted? TLS protects data in transit. Data at rest on our infrastructure uses encryption supplied by the cloud hosting environment. Integration credentials receive an extra encryption step before they are written to our database. Detail is in Section 7.
Do you expose a public integration API? No. Authenticated APIs exist for our own applications. There is no public REST API for unrelated third-party tools to connect to customer data. Detail is in Section 8.
What happens when a user disconnects an integration? OAuth tokens and connection metadata for that integration leave our active systems. Content already imported or generated in Product Map — chats or project context, for example — can remain until the customer deletes that Content or the account. Detail is in Section 9.
Do you share logs with third parties? Service logs are produced for security and operations. They stay inside our cloud environment and are not given to third-party analytics or monitoring vendors for that purpose. Detail is in Section 10.
Do you have SOC 2 or ISO 27001? The Services do not currently carry third-party compliance certifications. Detail is in Section 11.
How do you manage vulnerabilities? We run regular security tests and monitor our infrastructure. External reports go to [email protected]; we aim to acknowledge them within two business days, then triage and remediate by severity. Detail is in Section 12.
This policy describes security practices for the Product Map platform: material you upload, material we retrieve from connected integrations at your direction, and the account and operational data required to run the Services.
"Content" takes the meaning in our Privacy Policy: documents, notes, templates, prompts, AI conversations, outputs, and other product-management material you upload or create in the Services.
"Customer data" means Content, account information, integration connection metadata, and other information we process so we can provide the Services to you or your organization.
"End-User Data" (a phrase used in some partner or marketplace security questionnaires) means data, content, or information of an end user that we access, collect, or otherwise process in connection with use of the Services, including Content and data obtained from connected third-party services.
"Integrations" means optional links between Product Map and third-party tools (work management, documentation, design, analytics, or messaging platforms, for example) that a user authorizes through OAuth or, where offered, through API keys the user supplies.
The text below is a general account of our security practices. It is not a contract, a service-level agreement, or a data processing agreement. Business customers who need contractual commitments should contact us about a DPA, as described in our Privacy Policy and Terms of Use.
Customer data is stored on Product Map infrastructure, not inside the third-party applications you connect.
The following categories of Customer data are stored outside third-party applications and outside the end user's browser (temporary browser storage needed to run the web app is excluded):
Third-party passwords and personal access tokens for standard OAuth integrations are not stored.
Sections 4 and 5 describe storage locations and subprocessors. Collection and use for privacy purposes are covered in our Privacy Policy.
Customer data is processed on our servers and through approved subprocessors so we can run the Services, including AI features and optional integrations.
Customer data is processed outside third-party applications and outside the end user's browser (log processing and storage is covered in Section 10) for purposes that include:
Processing takes place in our application hosting environment and at subprocessors that supply AI, hosting, payments, email, and analytics. The categories processed are generally the same as the categories stored, as described in Section 2.
Customer-selectable data residency regions are not available.
Product Map does not support data residency options. Customers cannot confine storage or processing of Customer data to a chosen country or region (EU-only or US-only, for example) through a product setting or a standard plan.
Application data is hosted with Google Cloud in Ireland (EU), as described in our Privacy Policy. Some subprocessors, including our AI providers, may process data in the United States or other countries. See Sections 5 and 14.
Migration of in-scope Customer data between customer-selected residency locations is not supported, because multiple residency locations are not offered.
If your organization requires data residency, contact [email protected] before adopting the Services so we can discuss whether the current architecture meets your needs.
A limited set of subprocessors works under contract. Customer data is not sold.
Customer data is shared with service providers and subprocessors that help operate the Services. They may access Customer data only to perform services for us and must protect it under written agreements.
Current subprocessors include:
This list may change from time to time. The Privacy Policy carries the same subprocessor table and describes broader sharing.
AI subprocessors. AI features send relevant inputs (including prompts and Content) and outputs to our AI providers under API terms that do not permit training on your data. See our Privacy Policy, Section 8.
Business customers. Where personal data in your Content is processed on your behalf, we act as your processor. A Data Processing Agreement (DPA) is available on request. Contact [email protected].
Service logs that contain Customer data are not shared with third-party entities for their own purposes. See Section 10.
Users sign in to Product Map through our standard authentication flows. Integrations use OAuth. Third-party passwords and personal access tokens are not collected.
Product Map accounts. Users authenticate to the Services through the registration and login methods we support (email and password, and optional social login providers), as described in our Privacy Policy.
Third-party integrations. Where Integrations are available, OAuth 2.0 (three-legged OAuth) is used so users grant access inside the third-party service. Access and refresh tokens that result from that grant are stored in encrypted form to keep the connection.
We do not require or accept:
Connect only integrations you are authorized to use, and disconnect integrations you no longer need from project settings.
Encryption in transit and at rest, access controls, and related measures are used to protect Customer data.
Encryption in transit. Communication between users and the Services uses TLS (HTTPS).
Encryption at rest. Customer data stored on our infrastructure benefits from encryption at rest provided by our cloud hosting environment (including managed database and storage encryption). That arrangement is our approach to full-disk or platform-level encryption for data stored outside a user's browser.
Integration credentials. OAuth tokens and related integration secrets are encrypted with an application-level key before they are stored in our database.
Organizational measures. Additional measures include authenticated API access, role-based project permissions, access controls for production systems, logging, and regular database backups, as described in our Privacy Policy.
No method of transmission or storage is completely secure. See the disclaimer in our Privacy Policy, Section 11.
The Services rely on internal APIs for our applications. A public REST API for unrelated third-party tools is not offered.
Backend APIs used by our web application and related clients are operated by Product Map. Those endpoints require authentication and are not meant as a general-purpose integration surface for external products.
Remote REST APIs designed for unrelated third-party tools to access or sync Customer data from Product Map are not exposed.
Questions about enterprise or partnership access models can be sent to [email protected].
Customer data is kept while your account is active. Disconnecting an integration removes tokens; previously imported Content may stay until you delete it.
General retention. Account information and Content are retained for as long as you maintain an account, unless a longer period is required or permitted by law. See our Privacy Policy, Section 10.
Deleting Content. Projects, chats, and other Content can be deleted in the product. Deleted Content is removed from active systems and from backups on our standard backup cycle.
Deleting your account. You may delete your account through profile settings or by contacting us. Account deletion removes your account and Content from active databases and from backups on our standard backup cycle, subject to limited retention where required by law.
Disconnecting an integration. When you disconnect an Integration, the integration connection record and encrypted OAuth tokens for that provider and project are deleted. Content already stored in Product Map from prior use of that Integration (text fetched into a chat or saved in project context, for example) may remain until you delete the relevant project, chat, or account.
After you stop using the Services. Customer data may remain stored after you disconnect a specific Integration or stop using a particular feature, until you delete the underlying Content or account as described above.
Custom retention periods. Product Map does not offer customer-configurable retention periods (for example "delete all data after 30 days") through the product or standard plans. Retention follows the practices in this section and our Privacy Policy.
Service events are logged for security and operations. We monitor our infrastructure. Logs remain in our cloud environment and are not sold or shared with third-party log vendors.
We do log information related to use of the Services for security, reliability, and troubleshooting. Depending on configuration and events, logs may include technical and usage information described in our Privacy Policy (IP address, device and browser characteristics, timestamps, and records of activity within the Services, for example). Error or diagnostic cases may include references to URLs, resource identifiers, or similar metadata from connected integrations.
Logs are processed and stored in our cloud hosting environment (Google Cloud), not in third-party applications you connect.
Logs that contain Customer data are not shared with third-party entities for their own purposes. Log sharing is not integral to application functionality in that sense.
We monitor our infrastructure and the Services for availability, errors, abuse, and unusual activity. Logs are used for that monitoring, to investigate incidents, and to maintain the Services. Access to production logs is limited to personnel who need it for their role. Findings from monitoring that look like vulnerabilities or active incidents are handled under Sections 12 and 15.
Applicable privacy and security law is followed. SOC 2, ISO 27001, and similar certifications are not currently held.
Product Map Ltd is a company registered in England. Personal information is processed in accordance with the UK GDPR, EU GDPR, and other applicable laws, as described in our Privacy Policy and Terms of Use.
Third-party compliance certifications such as SOC 2, ISO 27001, HIPAA, or FedRAMP for the Services are not currently held.
Third-party marketplace bug bounty programs are not currently used unless we separately announce otherwise.
A CAIQ Lite questionnaire has not been completed for publication. Customers with specific assurance requirements may contact [email protected].
The Services are general-purpose product-management tools and are not designed for regulated sensitive data or industry-specific compliance regimes unless we agree otherwise in writing. See our Terms of Use, Section 1.
We identify issues through regular tests, infrastructure monitoring, and external reports. Reports are triaged by severity and remediated accordingly. Do not disclose publicly before we have had a reasonable chance to respond.
We maintain a vulnerability management process for the Services and related systems. It covers identification, reporting, triage, and remediation.
Identification. We run regular security tests of the application and related infrastructure. We monitor our infrastructure and service logs for errors, abuse, and unusual activity, as described in Section 10. We also review relevant security advisories for the platforms and components we rely on. Issues may be found internally or reported by users, customers, researchers, or partners.
Reporting. If you believe you have found a security vulnerability in the Services, or if you suspect unauthorized access to your account or data, contact us promptly at [email protected] with:
Triage. Incoming reports and internally identified issues are reviewed to confirm they are valid and in scope. Confirmed issues are classified by severity (critical, high, medium, or low) based on exploitability and potential impact on Customer data, accounts, or availability of the Services. We aim to acknowledge external reports within two business days. Additional information may be requested. Issues that indicate an active security incident are handled under Section 15.
Remediation. Validated issues are remediated according to severity:
We confirm that a fix or mitigation addresses the issue, including re-testing where applicable.
Please do not publicly disclose a vulnerability until we have had a reasonable opportunity to investigate and address it, unless disclosure is required by law.
A public bug bounty program or guaranteed reward schedule is not operated at this time.
We are generally a controller for account data and a processor for Content you control. Under the CCPA the same split is business and service provider.
This section restates roles already described in our Privacy Policy. It is here for security and vendor-review questionnaires.
GDPR / UK GDPR
CCPA (California)
Privacy rights and how to exercise them are in our Privacy Policy.
The company is UK-based. Application data is hosted in Ireland. Some subprocessors process data in the United States. SCCs and the UK IDTA are used where required.
We are based in the United Kingdom. Application data is hosted with Google Cloud in Ireland (EU).
Some subprocessors, including our AI providers (Anthropic and OpenAI), payment processor, analytics provider, and email provider, may process personal information in the United States or other countries outside your country of residence.
Where personal information is transferred from the EEA, UK, or Switzerland to countries without an adequacy decision, appropriate safeguards are used, including the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA), as described in our Privacy Policy.
More information about transfer mechanisms can be requested using the details in Section 18.
Security incidents are investigated. Authorities and users are notified when the law requires it.
Processes are maintained to detect, investigate, and respond to security incidents affecting the Services.
If a personal data breach affects your information, the relevant supervisory authority and affected individuals will be notified where required by applicable law (for example, under GDPR/UK GDPR Articles 33 to 34).
If you believe your account has been compromised, change your password (if applicable), revoke active sessions where the product allows, disconnect suspicious integrations, and contact us at [email protected].
You decide what you upload, who you invite, and which integrations you connect.
You are responsible for:
Enterprise or team administrators should manage user access and integration connections in line with their organization's policies.
This Security Policy may be updated from time to time.
This Security Policy may be updated to reflect changes in our practices, technology, legal requirements, or subprocessors. An updated "Last updated" date at the top of this page will mark the new version.
Material changes may be accompanied by additional notice (email or a notice in the Services, for example), consistent with the approach in the Privacy Policy and Terms of Use.
If you have questions about this Security Policy or our security practices, contact us at:
Product Map Ltd.
167-169 Great Portland St, 5th Floor,
London, England W1W 5PF,
England
Email: [email protected]
For privacy-specific questions or to contact our Data Protection Officer, see Section 18 of our Privacy Policy.
For a Data Processing Agreement or enterprise security review, email [email protected].
