Your statements are privileged. We treat them that way.

All traffic between you and Inverse is encrypted in transit over HTTPS/TLS. The statements, contracts, and findings you send us are stored in a managed cloud database and object storage that encrypt data at rest.

Inverse runs on SOC 2 Type II compliant cloud infrastructure — managed database, authentication, storage, and compute. The underlying platform is independently audited to SOC 2 Type II and hosted in facilities that also carry ISO 27001 and PCI DSS certifications. Payments are processed by Stripe (PCI DSS Level 1).

Access is scoped to your account at the database level. Row-level security means no other customer — and no unauthenticated request — can read your statements or findings. Every query runs as you, against only your rows.

We treat uploaded statements as privileged and confidential. They are used only to perform your royalty analysis, and are never sold, shared for advertising, or used to train third-party AI models — model calls run under enterprise API terms that contractually exclude your data from training.

You sign in with email and password or with Google. Passwords are checked against known breach databases (Have I Been Pwned) at sign-up and password change, so a compromised password can't be used to protect your account.

Sign in and analysis screens are gated — you must be authenticated to reach them.

We collect the statements and contracts you upload, the findings we generate from them, and basic account information (name, email, company). That's it. Each piece exists to run and deliver your analysis.

You can export a complete copy of your data, or permanently delete your account and everything tied to it, at any time — no email ticket required. Both live on your account & support screen once you're signed in.

Deleting your account removes your statements, findings, analysis runs, and stored files, and closes your login.

We honor data-subject rights under GDPR and CCPA, including the right to access, correct, export, and delete your personal data. The self-service export and deletion tools above cover access and erasure directly; for corrections or any other request, contact us and we'll act on it.

Inverse only uses the cookies and browser storage it needs to keep you signed in, take payments and protect your results. The one optional item is a referral cookie that records which link brought you to Inverse, so referrals can be credited. Visitors in the EU, UK and Switzerland are asked first and can change their choice any time. We don't use advertising or cross-site tracking cookies, and we don't sell or share personal information.

A Data Processing Agreement (DPA) is available to customers on request. If your organization requires a signed DPA before sending statements, reach out and we'll provide one.

We keep our subprocessor list short and purposeful: hosting and storage, payments, AI models that read contracts, email, the secure browser that signs in to portals you connect, bot protection and error reporting. The full list, with what each one does, is in our Privacy Policy. Stripe processes payments; Inverse never stores your full card details.

To report a vulnerability, ask a privacy question, or request a DPA, use our support form, or email hello@inversemusic.com. How we handle personal information is set out in our Privacy Policy.