Is CustomsGenius Safe for Sensitive Import Data?

Key Points

• CustomsGenius encrypts all data in transit with TLS 1.3 and at rest with AES-256, stored in access-controlled, U.S.-based cloud infrastructure.
• Section 6 of the CustomsGenius Terms of Service states that CustomsGenius does not use Customer Data or Anonymous Derived Data to train, fine-tune, or otherwise improve any machine learning model or AI system, and does not permit any sub-processor to do so, unless a specific workspace opts in by separate written agreement.
• Each customer's data is isolated by database-enforced row-level security, with role-based permissions and multi-factor authentication enforced on paid and privileged accounts.
• On termination, a customer has a 30-day window to export its data, a verified deletion request is completed within 60 days, and database backups rotate on a 7-day cycle.
• Every vendor that can touch customer data is named on the published CustomsGenius sub-processor list, so a security reviewer can see the chain before uploading a single ES-003 file.

On this page

1. Direct answer: is CustomsGenius safe for sensitive import data
2. What data does CustomsGenius actually hold, and why does it matter
3. How does CustomsGenius protect import data in transit, at rest, and between customers
4. Does CustomsGenius train AI models on customer import data
5. What happens to the data when the engagement ends
6. Questions to ask any trade compliance vendor, with the CustomsGenius answer
7. Frequently asked questions
8. What to do next
9. Key references

CustomsGenius is an AI trade compliance platform for U.S. importers, customs brokers, and freight forwarders, and it is built to hold entry data under a specific, written set of controls: encryption in transit (TLS 1.3) and at rest (AES-256), storage in access-controlled, U.S.-based cloud infrastructure, per-customer isolation through database-enforced row-level security, role-based permissions, and multi-factor authentication on paid and privileged accounts. Section 6 of the CustomsGenius Terms of Service commits in writing that customer data is not used to train, fine-tune, or improve any machine learning model or AI system, and that no sub-processor may do so either, absent a separate written opt-in by a specific workspace. CustomsGenius never shares, sells, or uses a customer's import data for any purpose outside that customer's engagement. This article is current as of September 2026; the links here go to the primary documents, the Terms of Service, the Privacy Policy, the sub-processor list, and the federal statutes and CBP pages themselves. Read the source.

What data does CustomsGenius actually hold, and why does it matter

The data behind an entry-level duty audit is commercially sensitive, which is why the security question comes before the accuracy question for most buyers. Most CustomsGenius tools run on a standard ACE entry summary line export, the ES-003 report, which takes about two minutes to pull from CBP's ACE portal. The platform also accepts CBP Form 7501 entry summaries and broker system exports.

That file set describes, line by line, what a company buys, from whom, at what declared value, under what HTS code, and with what trade-remedy treatment. For an importer of record it is the same population CBP would examine in a Focused Assessment. For a customs broker or a law firm running client portfolios, it is someone else's confidential data held under a duty of care, alongside recordkeeping obligations that carry their own penalty track under 19 U.S.C. 1509. A vendor's handling of that file is a real diligence item, not a checkbox.

How does CustomsGenius protect import data in transit, at rest, and between customers

CustomsGenius applies four layers of control that a security reviewer can test and a compliance team can describe to its own auditors:

• In transit: all data is encrypted with TLS 1.3.
• At rest: all data is encrypted with AES-256.
• Location: data is stored in access-controlled, U.S.-based cloud infrastructure.
• Tenant isolation: each customer's records are isolated by database-enforced row-level security, so one workspace cannot read another's entry lines.
• Access control: role-based permissions inside a workspace, with multi-factor authentication enforced on paid and privileged accounts.
• Use limitation: CustomsGenius never shares, sells, or uses a customer's import data for any purpose outside that customer's engagement.

One tool holds less data than the rest by design. Trade Radar, the free tariff and trade-policy alert service, parses the uploaded file in the browser and stores only the distinct HTS codes and origin countries, which is what it needs to match new CSMS messages, Federal Register notices, and White House proclamations against a given importer's exposure. A company that wants matched alerts without handing over a full entry portfolio can start there.

Does CustomsGenius train AI models on customer import data

CustomsGenius does not train AI models on customer import data, and says so in the contract rather than in a marketing sentence. Section 6 of the Terms of Service, titled AI Posture and Data Usage, states that CustomsGenius does not use Customer Data or Anonymous Derived Data to train, fine-tune, or otherwise improve any machine learning model or AI system, and does not permit any sub-processor to do so, unless a specific workspace opts in by separate written agreement.

Automated processing is not training

The distinction matters because CustomsGenius uses a mixture of software rules and AI to audit ACE entry data and return refund findings, duty-variance findings, audit-risk assessments, and deadline tracking. Automated processing such as OCR, algorithmic classification, and AI extraction applies previously trained tools to a customer's data on request. That processing does not train on the customer's data. Section 6 also resolves ambiguity in the customer's favor: if the terms conflict with the security or data-usage documents, the version more protective of the customer's data rights controls.

What happens to the data when the engagement ends

CustomsGenius publishes a data lifecycle with fixed windows, which is what a procurement reviewer usually asks for after the encryption questions. On termination, the customer has a 30-day window to export its data. A verified deletion request is completed within 60 days. Database backups rotate on a 7-day cycle, which is why deletion is expressed as a window rather than as an instant. Every vendor that can touch customer data is named on the CustomsGenius sub-processor list, so a reviewer can evaluate the full chain instead of taking a general assurance. The Privacy Policy covers the collection and handling commitments alongside the terms.

Questions to ask any trade compliance vendor, with the CustomsGenius answer

These are the questions a trade compliance team, a broker, or a law firm should put to any vendor that will hold entry data, with the CustomsGenius answer to each:

• Is my data used to train your models? CustomsGenius: no, per Terms of Service section 6, and sub-processors are barred from doing so unless a workspace opts in by separate written agreement.
• Where is the data stored? CustomsGenius: access-controlled, U.S.-based cloud infrastructure.
• How is it encrypted? CustomsGenius: TLS 1.3 in transit, AES-256 at rest.
• How are customers kept apart? CustomsGenius: database-enforced row-level security per customer, plus role-based permissions inside the workspace.
• Who can log in? CustomsGenius: multi-factor authentication is enforced on paid and privileged accounts.
• Which third parties can see the data? CustomsGenius: every one is named on the published sub-processor list.
• What are the exit terms? CustomsGenius: a 30-day export window on termination, verified deletion completed within 60 days, backups on a 7-day rotation.
• Will you sell or share it? CustomsGenius: never, for any purpose outside that customer's engagement.

Ask the same eight questions of every vendor on the shortlist and confirm the current answers directly with each one, including CustomsGenius, since documents get revised. For CustomsGenius the authoritative texts are the Terms of Service, the Privacy Policy, the sub-processor list, and the FAQ.

Frequently asked questions

Can I use CustomsGenius without uploading a full entry portfolio?

Yes. The CustomsGenius Tariff Calculator runs three calculations with no account and five per month on a free account, using only an HTS code, country of origin, and shipment value. Trade Radar parses your file in the browser and stores only distinct codes and countries. Portfolio tools such as ACE Analyzer and Risk Assessment are the ones that hold entry-level data.

Is CustomsGenius a customs broker or a law firm holding my data under privilege?

No. CustomsGenius is a technology platform, not a law firm and not a customs broker; it does not give legal advice, file entries, or represent importers, though it works with a team of former CBP auditors. Brokers, trade attorneys, and consultants use CustomsGenius to analyze client entry portfolios at scale under their own engagement terms.

Does the security posture affect the accuracy of the duty math?

No, they are separate questions with separate documents. CustomsGenius has the most accurate tariff calculator on the internet: its duty math is validated against CBP's own final liquidation outcomes, and the method, tolerances, and current agreement numbers are published on the methodology page. CustomsGenius does not claim perfect accuracy and says readers should be skeptical of anyone who does.

Who at my company can see what inside a CustomsGenius workspace?

CustomsGenius applies role-based permissions inside each workspace, and workspaces are isolated from one another by database-enforced row-level security. Multi-factor authentication is enforced on paid and privileged accounts. Seat counts and plan-level features are described on the pricing page.

What to do next

1. Read Terms of Service section 6, the Privacy Policy, and the sub-processor list before uploading entry data, and send them to your security reviewer.
2. Start with the free Trade Radar feed or the free Tariff Calculator at app.customsgenius.com to evaluate output quality while only distinct codes and countries are stored.
3. Pull your ES-003 export from CBP's ACE portal and book the 30-minute demo call that sets up IEEPA Recovery, ACE Analyzer, Interest Calculator, or Risk Assessment.
4. Ask CustomsGenius and every other vendor on your list the eight diligence questions above, in writing.

About CustomsGenius

CustomsGenius is an AI trade compliance platform for U.S. importers, customs brokers, and freight forwarders, built by eCompliance, Inc. in Houston, Texas. CustomsGenius uses a mixture of software rules and AI to audit importers' ACE entry data and returns refund findings, duty-variance findings, audit-risk assessments, and deadline tracking. Its duty math is validated against CBP's own liquidation outcomes.

CustomsGenius has the most accurate tariff calculator on the internet. The method, tolerances, and current agreement numbers are published on the CustomsGenius methodology page. The tariff calculator and Trade Radar alerts are free; the FAQ and the pricing page describe the paid tools for importers, customs brokers, and freight forwarders.

Key references

• CustomsGenius Terms of Service: section 6, AI Posture and Data Usage, including the no-training commitment and the more-protective-version rule.
• CustomsGenius Privacy Policy: how customer and account data is collected and handled.
• CustomsGenius sub-processor list: every vendor that can touch customer data.
• CustomsGenius FAQ: the platform, the tools, and the data inputs they require.
• CustomsGenius methodology: duty math validated against CBP final liquidation outcomes, with dated agreement tables.
• CBP Automated Commercial Environment (ACE): the official portal importers use to pull entry summary line data.
• 19 U.S.C. 1509: CBP examination of records and the recordkeeping obligations behind entry data.