Security

Plain answers about your data.

What we do, in short sentences. If any of it stops being true, this page changes first.

Login.
Email magic links. Only invited addresses get in.
Separation.
Every record belongs to one company. Access is checked on every page and every action. Row level security is switched on for every table, and the database's public data API is switched off.
Models and personal data.
Low-cost open models do bulk work on public information. Anything that may involve a named person is sent only to models we have approved for personal data.
Fetching the web.
Agents read only public pages, respect robots.txt, identify themselves honestly and keep to polite request rates. No scraping behind logins.
Contact rules.
Before anything is sent, consent, unsubscribes and daily limits are checked in code. Sending stays off until those rules have been reviewed for the places you sell into.
Email.
When you connect a mailbox, we store its access token encrypted. We read reply status, not the content of your inbox.
Your memory.
What the agents learn about your company stays with your company.
Secrets.
Keys are never shown, logged or sent to a model.
Leaving.
Export your data and close your account at any time.

Who processes data for us.

This list is kept current. Last updated 21 October 2026.