1. Who we are
Customs OS, Inc. (“Customs OS”, “we”, “us”) builds software for licensed U.S. customs brokers. When you sign up for an account, book a demo, or submit a document packet for validation, we become a data processor on your behalf.
2. What we collect
- Account data: your name, work email, organization, role, and authentication metadata.
- Packet data: the documents you upload for validation (commercial invoices, packing lists, BOLs, ISFs, arrival notices) and any extracted fields, cross-check results, or agent outputs derived from them.
- Usage data: product events (uploads, runs, approvals), performance logs, and error traces. These are scoped to your tenant and retained for operational purposes only.
- Support data: messages you send us, and messages we send you.
3. What we do not collect
- We do not sell or rent personal data. We never have.
- We do not use your packet contents to train third-party models outside of inference calls required to deliver the product.
- We do not place advertising cookies or third-party marketing trackers on product surfaces.
4. How we use it
- To run the product: extract fields, reconcile documents, surface issues, and return results to your team.
- To operate the service: monitoring, debugging, fraud and abuse prevention.
- To communicate: product updates, security notices, invoices. You can opt out of non-essential email at any time.
5. Sub-processors
We run on a small, vetted set of U.S.-resident infrastructure. Our current sub-processors include:
- Supabase (managed Postgres, file metadata, auth adjacency)
- Better Auth (authentication and session management)
- Cloudflare R2 (document object storage)
- Google Cloud (Gemini models for extraction and validation)
- Inngest (durable background workflows)
- Vercel (web hosting)
A current, versioned list is available on request. We give at least 30 days' notice before adding or changing a sub-processor that touches customer data.
6. Data residency and retention
Primary storage is in U.S. regions. Packet data is retained for as long as your account is active, plus 30 days after deletion to allow recovery from accidental removal. You can request earlier erasure in writing; we will honor it within 30 days unless we're legally required to retain specific records.
7. Security
- Encryption in transit (TLS 1.2+) and at rest (AES-256).
- Tenant isolation at the application and database layer.
- Principle of least privilege for internal access.
- Incident response: if we experience a breach that affects your data, we'll notify the primary contact on your account within 72 hours of discovery.
8. Your rights
You can access, export, correct, or delete your data at any time. To make a request, reach out to us using the contact details below. If you are covered under the GDPR or CCPA, you have the additional rights described in those laws; we will honor them.
9. Contact
The fastest way to reach us is to book a short call. If you're reviewing this before a security questionnaire, let us know on the call and we'll walk you through the details.