Security

Hosting and network

• The Service runs on dedicated servers at Hetzner, deployed with our own Coolify installation. Customer data does not pass through the deployment tool's vendor.
• All traffic goes through Cloudflare (DNS, DDoS and bot protection, web application firewall). The origin server accepts traffic from Cloudflare only.
• Connections use TLS. Browsers get a strict Content-Security-Policy and other security headers.

Encryption

• Data is encrypted in transit between you, Cloudflare and our servers.
• Secrets and tokens we hold for you (for example calendar and integration tokens) are additionally encrypted by the application with keys kept outside the database.
• Passwords are stored only as salted hashes. Database backups are encrypted before they leave the server with a key the server cannot read.

Access controls

• Each organization's data is isolated in the database itself (row-level security), not only in application code, so one customer cannot read another's rows.
• Role-based permissions and brand scopes decide what each person sees. gr0 and automations follow the same limits.
• Two-factor sign-in, sign-in lockout and bot checks, remembered devices that expire, and step-up confirmation for sensitive actions.
• An append-only audit log records sensitive changes. Our staff access to customer organizations is limited, time-boxed and logged.

AI safeguards

• Requests on paid AI models carry a no-data-collection preference. Features that read bank, credit or identity data never use free model routes.
• Calendar events reach an AI model only on a paid model through OpenRouter that keeps no copy (zero data retention), never a free model. The text of those requests, and of bank, credit and identity requests, is left out of our AI monitoring records.
• We do not train models on customer data. AI cannot approve anything; a person decides.

Operating practices

• Automated tests, including accessibility and security tests, run before every release.
• Dependencies and infrastructure are updated regularly; secrets are kept out of source control.

We have not completed a third-party audit certification yet. Ask us for our security questionnaire answers.

Report a vulnerability

Email [email protected] with the details and how to reproduce it. We read every report, reply within 3 business days, and will not take action against good-faith research that avoids other people's data, service disruption and public disclosure before we have fixed it. Please do not test with real customer data or run denial-of-service tests.