Security & data

Where your data lives

• One database, separated by workspace. Every customer table carries a workspace id, and PostgreSQL row-level security is forced on each one: a query can only ever see the workspace it was opened for, and that includes the database owner.
• Region. The database runs on Google Cloud SQL (PostgreSQL 17) in us-central1. The application runs on Cloudflare’s network; requests are served close to you and the data stays in one place.
• In transit. HTTPS everywhere, HSTS on, a strict content-security policy on the app, and no third-party scripts in it.

Who can get in

• Sign-in is handled by WorkOS: password, Google, or an emailed link. Multi-factor authentication is not required today.
• Roles — owner, admin, member, viewer — are enforced on the server for every request, not only in the interface.
• Invitations are per email address and expire after seven days. A person who signs in with a verified email is admitted only to workspaces that invited that exact address; an unverified email admits no one.
• Rate limits on sign-in, invitations, writes and the voice assistant slow down abuse.

What is recorded

• Changes to contacts, companies, deals, team membership, custom fields and channels are written to an append-only audit log by the database itself. The application’s database role cannot update or delete audit rows. Owners and admins can read it in the app under Activity.
• Not yet audited: edits to messages, and the person’s own IP address (the log records our proxy’s).

The assistant

• The voice and text assistant is built on Hume AI, with Anthropic’s Claude as the model. It reads your workspace through the same permission checks as the app and changes nothing: it can look things up and open screens.
• Each request carries only the records needed to answer it. Zero-data-retention and no-training settings are enabled with both vendors. A data-processing agreement with Hume is in progress, not signed.

Messaging

• Text messages go through Telnyx and email through Amazon SES. STOP, UNSUBSCRIBE and similar replies switch texting off for that contact immediately, and the app refuses to text anyone without consent on record — including contacts brought in by import, until they text you or you record how they agreed.

Backups and recovery

• Daily automated backups (seven kept) and point-in-time recovery covering the last seven days.
• Tested. On September 22, 2026 we restored the production database to a point in time on a separate instance in 11 minutes and verified every workspace’s data before deleting it. Recovery point: minutes. Recovery time: about 15 minutes plus a configuration change. We repeat this quarterly.
• The database is single-zone; a zone outage means a restore rather than automatic failover.

Monitoring

• Independent uptime checks probe the app’s database health every minute and the website every five, from several regions, and raise an alert when they fail for three minutes. Alerts go to the founders; there is no 24/7 on-call rotation.

Who processes data for us

We will update this list before adding a provider that touches customer data.

What we do not have yet

• No SOC 2 report and no completed third-party penetration test.
• No self-service data export or workspace deletion; both are done on request by us, and we confirm when it is complete.
• No single sign-on (SAML) or user provisioning (SCIM).
• No enforced multi-factor authentication.
• No signed data-processing agreement with Hume AI.

These are listed so you can decide with the facts. Each has an owner; ask and we will tell you where it stands.

Requests and reports

For a copy of your data, deletion, a security question, or to report a vulnerability, email [email protected]. We answer within two business days and will not pursue anyone who reports a problem in good faith.