Privacy & security

Crux is currently an invite-only pilot operated by We Scale Startups. This notice explains the information used to run the pilot and the controls currently in place. Last updated 29 July 2026.

Information used

• Your account email and authentication records.
• Company information you enter into your private workspace.
• Your goal, the assumptions Crux identifies, the tests you run, the evidence you record and the decisions you take.
• Operational logs needed to diagnose reliability and security issues.

How it is used

Information is used to provide the Crux workspace, identify and rank your assumptions, design tests, judge the evidence you record, support the pilot and evaluate whether the product is useful. We do not sell pilot data.

Current safeguards

• Invite-only access and private authenticated workspaces.
• User-scoped application and database access controls.
• Encrypted HTTPS connections and managed hosting.

Subprocessors and hosting

We use a small number of subprocessors to run Crux, and don’t share pilot data beyond them:

• Supabase — database, authentication and file storage, hosted in the EU (London region).
• Vercel — application hosting for the Crux web app.
• DeepSeek — powers assumption discovery, ranking, test design and evidence analysis (see “AI processing” below).

AI processing

Crux uses DeepSeek(Hangzhou DeepSeek Artificial Intelligence Co., Ltd.), a third-party AI provider, for four tasks: identifying your assumptions, ranking them, designing a test, and analysing the evidence you record. Only the fields needed for that task are sent to DeepSeek’s API: your goal, company stage and description, what Crux knows about your customer, your open assumptions, the evidence recorded against them and previous decisions. That processing can happen on DeepSeek infrastructure in China. An exact copy of what was sent is stored with each run so you can see it.

We do not send account email, internal user identifiers, analytics events or unrelated historical text. Under DeepSeek’s published policies, submitted content may be used in de-identified form to improve its services unless an applicable training control is enabled. We have not represented that control as enabled for the pilot. Treat information sent to DeepSeek the way you’d treat any third-party AI tool. Do not enter passwords, payment-card data, health information or other unnecessary sensitive information into your workspace.

Everything the AI produces is validated before it is saved: it may only cite evidence you supplied, and claims about your product, price or customers are checked against a published capability list. Retries are bounded rather than open-ended.

Access, correction and deletion

To request a copy, correction or deletion of pilot data, or to report a security concern, email daniel@wescalestartups.com. Account and workspace data is retained for as long as your pilot account is active. If you request deletion, we remove it from our active systems promptly; it may persist for a limited time in encrypted backups before being purged during routine backup rotation, or longer where we’re required to keep it for legal reasons.

Pilot status

Crux is an experimental product. It provides recommendations and evidence-tracking support, not guaranteed business outcomes. Founders remain responsible for business decisions and for the information they choose to enter.

This notice is suitable for the beta. Broader commercial release remains subject to legal review of international processing, retention and data-protection terms.