Heista Trust Center

Heista is the creative development workspace for agencies and creative teams. It runs on independently certified infrastructure, stores your data in Sydney, and doesn’t train AI on your work.

Company

Mighty Lucky Ventures Pty Ltd, trading as Heista (ABN 51 653 328 628), Australia

Data stored in

Sydney, Australia

Hosting

Vercel

Database, sign-in and file storage

Supabase

AI access

Vercel AI Gateway

Contact

support@heista.co

Are you SOC 2 or ISO 27001 certified?

Heista does not currently hold its own SOC 2 attestation or ISO 27001 certification. Heista’s core infrastructure runs on Vercel (hosting) and Supabase (database, authentication and file storage), both of which hold SOC 2 Type II attestations and ISO/IEC 27001:2022 certifications.

Customer data is stored in Sydney, Australia, and isolated per workspace at the database layer. Heista does not train AI models on customer data. We complete vendor security questionnaires and can brief your security team on our controls on request. Independent certification is on our roadmap.

Heista is built on Vercel (hosting) and Supabase (database, authentication and file storage). Customer data is stored in Sydney, Australia.

Heista’s data is hosted in Sydney, Australia, on Vercel and Supabase. Dedicated UK, US or EU hosting is available on Enterprise by agreement.

AI requests are routed through Vercel AI Gateway to the AI provider you choose. Providers run servers in many countries, and each request goes to whichever available server can complete it, so AI processing may happen outside Australia (for example the US, EU or Asia). Your stored data stays in Sydney. Using Heista’s AI features means agreeing to this.

• Heista is hosted on Vercel, which provides a global delivery network, automatic DDoS protection and a web application firewall. Application servers run in Vercel’s Sydney region.
• The database, authentication and file storage run in Supabase’s Sydney region (ap-southeast-2), where daily database backups are also held.
• AI requests are routed through Vercel AI Gateway to the provider of the selected model. Vercel does not retain or train on requests passing through the Gateway.
• Payments are processed through Stripe’s hosted checkout. Card details are entered on Stripe’s pages and never reach Heista’s servers.

Vercel

SOC 2 Type II · ISO/IEC 27001:2022

Supabase

SOC 2 Type II · ISO/IEC 27001:2022

Encryption at rest

AES-256 (Vercel and Supabase)

Encryption in transit

TLS on all connections

Each customer’s data is isolated in its own workspace, enforced at the database layer.

Isolation is enforced by Postgres Row-Level Security, which is enabled on every table, rather than by application code alone. Every request is checked against the user’s active workspace membership before any data is returned.

How Row-Level Security works

Every record in Heista’s database carries the identifier of the workspace it belongs to. Each table has rules, enforced by the database engine itself, that allow a record to be read or changed only by an active member of that workspace. Because these rules run inside the database on every query, they still apply if application code makes a mistake: a request for another workspace’s records returns nothing.

• Workspaces are invitation-only. An invitation can only be accepted by the email address it was sent to.
• A removed member loses access from their next request.
• Server processes that require elevated database access verify the caller’s identity and scope every query to the caller’s workspace.

Access-control testing

Workspace isolation has been verified through access-control testing against the production environment. The most recent review (October 2026) found no cross-workspace data access. The only content shared across workspaces is Heista’s public ad library, by design.

Files are held in private, encrypted storage in Sydney, accessible only to your workspace and shared only through expiring links.

• Brand documents, strategy files, chat attachments and studio uploads are held in private storage and accessed through signed, time-limited links. Public ad-library media, workspace branding assets and some previews use public links, and media sent to some video models is placed at a temporary link that is deleted when the render finishes.
• Files are stored under your workspace and accessible only to its members.
• Files are encrypted at rest (AES-256) and in transit (TLS).
• Access to private files is granted through signed, time-limited URLs.
• Videos and images uploaded for decoding remain private to your workspace. They are not published, indexed by search engines, added to the Decoded Library or surfaced to other workspaces, and they are deleted, together with their decodes, when the workspace is deleted.
• Session recording is disabled in our product analytics.

What the AI sees

Each AI request contains only what the task requires: the prompt, any attached references or documents, and relevant brand context from your workspace. Requests are routed through Vercel AI Gateway to the provider of the selected model.

Uploaded documents are processed by an AI model to extract their text, which is stored in your workspace for use by your team’s AI tools.

What Heista stores, where it is kept, who can access it and for how long.

Heista does not train AI models on customer data, and instructs AI providers not to train on it: on every text request, and on image and video requests wherever the provider supports it.

Text and chat AI

Every text, chat, embedding, ranking and transcription request that Heista’s customer-facing features send through Vercel AI Gateway carries a no-training instruction, and is only served by providers that have agreed not to train on it. That covers Creative Director, decoding, scripts and the background jobs behind them. These requests are never retried without the instruction.

Image and video AI

Image and video requests carry the same no-training instruction wherever the provider supports it. The following providers do not currently offer a no-training option through the Gateway:

• Black Forest Labs (the FLUX image models)
• Recraft (image models)
• MiniMax (Hailuo video models)
• HeyGen (HeyGen Video)
• Topaz Labs (image upscaling)

These models remain available for their output quality. As their providers are not covered by a no-training commitment, content sent to them may be used to improve their models. We recommend selecting another model for sensitive material. Enterprise customers can restrict which models their team can use.

Heista’s own use of data

Heista does not train AI models on customer inputs, uploads or outputs.

Where AI processing happens

AI requests are routed through Vercel AI Gateway to the AI provider you choose. Providers run servers in many countries, and each request goes to whichever available server can complete it, so AI processing may happen outside Australia (for example the US, EU or Asia). Your stored data stays in Sydney. Using Heista’s AI features means agreeing to this.

Model updates

New models are added following internal evaluation. Models may be added, updated or retired at Heista’s discretion, including when a provider retires them. Each model is supplied under its provider’s terms, and customers can choose which models their work uses. Some features start with a default model, which is shown in the app.

Enterprise options

Enterprise agreements can add approved-model lists, a Zero Data Retention mode and your own provider keys. See Enterprise below.

Third parties that process customer data on Heista’s behalf, with their purpose, location and verified certifications.

AI model providers

Heista accesses AI models through Vercel AI Gateway. The providers below may process AI requests; the table shows whether each honours Heista’s no-training instruction.

Our vendors’ own subprocessors

• Vercel’s own subprocessors are listed at vercel.com/legal/sub-processors.
• Supabase’s own subprocessors are listed at supabase.com/legal/customer-resources/subprocessor-list.
• Stripe’s own subprocessors are listed at stripe.com/legal/service-providers.
• PostHog’s own subprocessors are listed at posthog.com/subprocessors.

Users sign in with Google, a one-time email link or a password, with role-based access in each workspace. Multi-factor authentication is enforced on all administrative access to Heista’s infrastructure.

Signing in

Sign-in is available through Google, a one-time email link, or email and password. Passwords are checked against known breach data, and compromised passwords are rejected.

Team roles

Owner

Everything an Admin can do, plus transferring ownership of the workspace.

Admin

Manages members, billing, seats, usage and settings. Cannot remove the owner or other admins.

Member

Uses Heista and creates work in the workspace.

Guest

Works in the workspace with the same access as a Member, for collaborators you invite in.

Workspace usage and spend are visible to owners and admins only.

Internal access

• Multi-factor authentication is enforced on all administrative accounts across hosting, database, source code and analytics.
• Production access is restricted to authorised personnel.
• Support access to customer data is limited to authorised personnel, uses a separate administrative sign-in, and is used only to provide support.
• Heista personnel cannot sign in as a customer or act on a customer’s behalf within their workspace.

Security is built into how Heista is developed and run, from code review to firewall protection.

Secure development

• Every deployment is built and type-checked automatically, and does not go live if that check fails. Changes are tested before release.
• Changes to security-sensitive and billing code receive an independent review before release.
• Dependency security alerts are enabled on our source code, and automated fixes are proposed for known issues in third-party packages.
• Commits are scanned for secrets, such as API keys, before they enter the codebase.
• Production secrets are stored encrypted in our hosting provider’s environment settings, never in source code.

Protecting the running service

• Vercel’s web application firewall, DDoS protection and bot monitoring sit in front of every request.
• API endpoints are rate limited, and user input is validated on the server.
• Requests Heista makes to web addresses you provide are checked to block access to internal networks.
• File uploads are limited by size and file type, and public storage does not accept file types that can carry scripts.
• Automated monitoring runs every five minutes and alerts on elevated error rates and stalled jobs.

Daily database backups in Sydney, continuous monitoring, and a direct line for incident reporting.

• Daily database backups, kept for 7 days and stored in Sydney.
• Every release is an immutable deployment on Vercel’s global network, enabling rapid rollback.
• Automated monitoring runs every five minutes and alerts on elevated error rates and stalled jobs.

Incidents

Security concerns and incidents can be reported to support@heista.co. Heista follows a documented data breach response plan covering containment, assessment and notification. Where an incident affects customer data, Heista will notify affected customers, and the regulator where required, under Australia’s Notifiable Data Breaches scheme.

Security researchers should follow our responsible disclosure policy at heista.co/security.

Service levels are not included in the standard Terms and can be agreed as part of an Enterprise agreement.

Accounts can be deleted at any time. Deletion becomes permanent after a 90-day recovery period.

• Accounts are deleted from Settings and can be restored within 90 days. Reminder emails are sent 7 days and 1 day before deletion becomes permanent.
• After 90 days, the account and its workspace, including uploaded and generated files and the decodes of uploaded ads, are permanently deleted by an automated process.
• Decodes of public ad links belong to Heista and are kept when a workspace is deleted. They move to Heista’s own library, and anything linking them to the workspace or its members is removed.
• Work created in a workspace belongs to the workspace. When a member leaves or deletes their account, the work they created stays with the workspace and their name is removed from it; only their personal items (private chats and apps, favourites, preferences and the integrations they connected) are deleted.
• A sole owner of a workspace with other members must first transfer ownership or delete the workspace.
• Deleting a brand document immediately removes the file and its extracted text.
• Deleted boards are permanently removed after 30 days.
• Deleted data may persist in rolling database backups for up to 7 days.
• Billing records are retained for 7 years for tax purposes, separately from user accounts.
• Workspace data is retained for as long as the account remains active.

Heista handles personal information under the Australian Privacy Act, never sells it, and responds to requests within 30 days.

• Heista handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and does not sell personal information.
• Personal information your team adds to Heista, such as client or customer details, is handled on your behalf and only to provide the Service. A data processing agreement is available for Enterprise customers.
• Some providers process information outside Australia, as listed under Subprocessors. AI requests may be processed in any country where the selected provider operates.
• Requests to access, correct or delete personal information are acknowledged within 5 business days and answered within 30 days.
• Assets can be downloaded from the app at any time. Other exports are available on request where reasonably practicable.
• Heista does not use personal information to make automated decisions that significantly affect individuals.

Customers own what they create. Uploaded material remains theirs and confidential. Customers control and are responsible for what they publish.

• You own your inputs (the files, documents and briefs you bring) and the work you create in Heista, as far as the law where you are allows. Heista claims no ownership of your work.
• You can use what you create commercially, including for your clients.
• Anything you upload from your own device is your confidential material. It stays private to your workspace and never enters the Decoded Library.
• Your brand data (brand profiles, documents, briefs, scripts and saved assets) is never shared or published.
• Decoding a public ad link adds its structural intelligence (the formula, beats and psychology) to Heista’s Decoded Library. That intelligence belongs to Heista, may be shown to other users, and is kept if your workspace is deleted.
• You’re responsible for what you upload, prompt and publish: having the rights to your inputs, and checking outputs before you use them for third-party rights, likenesses, and advertising-platform and AI-labelling rules.

AI providers filter unsafe requests, our acceptable use policy sets clear limits, and anyone can report content to us.

• Each AI provider applies its own safety filters to prompts, references and outputs, so some requests are blocked or altered depending on the model.
• Our Terms of Service prohibit unlawful, infringing, deceptive and harmful content, including misuse of real people’s likenesses.
• Rights holders and members of the public can report content to support@heista.co with the page address and the basis of the report. Reports are acknowledged within 5 business days and investigated, and content is removed where appropriate.
• Accounts that repeatedly infringe the rights of others may be suspended or terminated.

You pay for AI as you use it, with Heista Credits. AI models are billed at what the provider charges, and you can see every charge.

• One Heista Credit is US$1. Credits come in packs from $10 to $200. Plans are priced per month (Individual Studio) or per seat (Team Studio), with credits bought separately.
• AI models are charged at exactly what the model provider charges, with no markup. Heista’s own tools, such as decoding an ad, have their own set price per use.
• A 4.9% AI Infrastructure Fee is added to each credit purchase and shown before you pay.
• Prices are in US dollars and exclude GST. Australian customers pay 10% GST on top, shown on a tax invoice. Customers outside Australia pay no Australian GST. You always receive the full credit amount.
• Purchased credits last 90 days from purchase.
• Failed generations are not charged. Where a charged run delivers no output, the credits are refunded.
• Each generation displays its cost. Owners and admins can see spend by app, member and day in Settings, and export every charge, with its model and provider, as a CSV.
• Per-member weekly or monthly spend limits are available with the Agency add-on, on the Team Studio plan.
• Card details are handled by Stripe and never reach Heista.

Payment security and fraud protection

• Payments are processed by Stripe, a PCI DSS Level 1 Service Provider.
• Credit balances can only be changed by Heista’s servers, never from a browser, and every change is recorded in a ledger.
• Spending is monitored daily, with alerts on unusual usage.
• Every charge is recorded with the model and provider used, and can be exported by workspace owners and admins.

Additional controls available under an Enterprise agreement.

Answers to the questions security and procurement teams ask most often.

Is Heista SOC 2 or ISO 27001 certified?

Heista does not currently hold its own SOC 2 attestation or ISO 27001 certification. Its hosting (Vercel) and database, authentication and storage (Supabase) providers hold SOC 2 Type II attestations and ISO/IEC 27001:2022 certifications. Independent certification is on our roadmap.

Where is our data stored?

In Sydney, Australia. Dedicated UK, US or EU hosting is available on Enterprise by agreement.

Is our data encrypted?

Yes. All connections use TLS, and the database and file storage are encrypted at rest with AES-256.

How is our data kept separate from other customers?

By Postgres Row-Level Security on every table, which allows a record to be read only by members of the workspace it belongs to. See Keeping workspaces separate.

Is our data used to train AI?

Heista does not train AI models on customer data, and instructs AI providers not to. See AI and your data for the few providers that do not offer this.

Who at Heista can access our data?

Only authorised personnel, through a separate administrative sign-in protected by multi-factor authentication, and only to provide support. Heista personnel cannot sign in as a customer.

Do you support single sign-on?

Users can sign in with Google, which applies your organisation’s Google Workspace sign-in policies. SAML single sign-on is available on Enterprise on request.

How are API keys protected?

API keys are shown once, stored only as one-way hashes, can be revoked at any time and can be restricted to specific IP addresses.

How is data backed up?

The database is backed up daily in Sydney, and backups are kept for 7 days.

What happens if there is a security incident?

We follow a documented data breach response plan: contain the issue, assess it, and notify affected customers, and the regulator where required, under Australia’s Notifiable Data Breaches scheme.

How do you manage third-party vendors?

Every vendor that processes customer data is listed under Subprocessors with its purpose and location, and certifications are listed only where verified against the vendor’s own documentation.

Can we delete our data?

Yes. Accounts can be deleted from Settings, with a 90-day recovery period before your workspace data, including uploads and the decodes of uploaded ads, is permanently deleted. Decodes of public ad links belong to Heista and are kept, with anything linking them to you or your workspace removed.

Do you have a responsible disclosure policy?

Yes. Security researchers can report issues under the policy published at heista.co/security.

Is there an uptime SLA?

Service levels can be agreed as part of an Enterprise agreement.

Vendor security questionnaires are completed on request.

Send your questionnaire and required turnaround to support@heista.co. We can also brief your security or IT team on Heista’s architecture and controls. The following are available on request:

• Completed vendor security questionnaires
• A data processing agreement, for Enterprise customers
• A PDF copy of this Trust Center, using the print button
• Our infrastructure providers’ own security reports, through their trust portals

Changes to this Trust Center.

• 4 October 2026: Work created in a shared workspace now stays with the workspace when a member deletes their account.
• 4 October 2026: Set out what happens to decoded ads when a workspace is deleted: decodes of public ad links are kept by Heista with links to the workspace removed, and decodes of uploaded ads are deleted with their files.
• 4 October 2026: Added data we hold, application security, privacy and your rights, content safety, the security FAQ and our data breach response plan.
• 2 October 2026: Trust Center published.

One address for security questions, incidents, privacy requests and Enterprise: support@heista.co.

Mighty Lucky Ventures Pty Ltd, trading as Heista. ABN 51 653 328 628. Australia.