How we keep your business's data safe.

Your records are walled off

Every table that holds a business's data checks, in the database itself, that the person asking belongs to that business, for reading and for writing. One customer's account cannot open another's, even if the app above it made a mistake.

Keys you add are sealed

If you add your own key from an AI company, it is locked with its own key, which is locked again with ours (AES-256). It is used only to send your work to that company and is never written to our logs.

Every change is checked

Each change to the app runs automatic checks: the tests, a check that one business cannot see another's data, a scan for leaked passwords and keys, and a full build. A deeper automated security review of all the code runs from time to time, and its reports are kept.

You can take your data and go

Export everything your business holds, or delete your account, from Settings. Both are buttons, not support tickets.

Web pages cannot give the team orders

When the team reads a web page or another outside source, that text is marked as outside text before the AI sees it, and the AI is told not to take instructions from it.

Emails only go to people who may get them

Before any email goes out, the app checks that the person has not opted out and, if you switch it on, that they agreed to hear from you. It is checked in code, not left to policy, which is what POPIA asks of you.

SOC 2 Type II

ISO 27001

POPIA Information Officer

Browser notifications