How we handle your data.

Your data stays inside your workspace.

• Encryption in transit and at restTraffic travels over HTTPS only, with HSTS set for two years. The database and file storage are encrypted at rest, and integration secrets are additionally encrypted with AES-256-GCM.
• Workspace isolationEvery read and write checks that the requester is a member of that workspace before it runs. Data from other workspaces is never shown.
• Roles and sign-in policyOwner, admin, editor and viewer roles narrow what each person can do. Owners can choose which sign-in methods and email domains members may use.
• Staff access controlsWhen staff view customer data through the operations console they must record a reason, and access is read-only for at most 15 minutes. Access logs are kept.
• Activity historyHard-to-undo actions such as adding or removing members, changing roles and deleting are recorded in the workspace activity history with who and when.
• Report a vulnerabilityIf you find a security vulnerability, tell us through the contact page. We will look into it and reply.

We watch the service so it keeps running.

• Managed cloud infrastructureThe application, database and file storage run on cloud services such as Vercel, Neon and Cloudflare. Servers and data sit in access-controlled data centers operated by these providers.
• Error monitoringErrors on the server and in the browser are collected in real time so we can respond. Request bodies and cookies are removed before server error records are sent.
• Abuse protectionBot protection and rate limiting block brute-force attempts and excessive requests. Requesting and entering sign-in codes is limited per account and per IP address.
• Incident responseIf we become aware of a personal data breach, we notify the affected people within 72 hours and report to the authorities where the law requires.

Your data belongs to you.

• We do not sell personal informationWe do not sell our customers' personal information. Purposes, data items and retention periods are set out in the privacy policy.
• Export and deletionOwners and admins can download workspace data as a ZIP file. Closing an account takes effect immediately, and only the records the law requires us to keep are set aside for the required period.
• Data processing agreement (DPA)On request we sign a data processing agreement that meets GDPR Article 28. International transfers rely on lawful mechanisms such as the EU Standard Contractual Clauses.
• Published subprocessorsThe companies we use to provide the service are listed below. If a company that processes customer content changes, we give 30 days' notice.
• AI featuresAI features send to the AI providers below only what the processing you asked for needs. AI usage records do not keep the text you entered.
• Your rightsYou can ask to access, correct or delete your data, to stop processing, or to withdraw consent. We act or reply within 10 days of receiving the request.

Subprocessors

The companies and countries we use to process personal information in order to provide the service. Data items and retention periods are in the privacy policy.

Certifications and privacy laws

• ISO/IEC 27001We hold certification to the international standard for information security management systems.
• GDPRWe process the personal data of users in the EEA, the UK and Switzerland under the GDPR and uphold data subject rights.
• CCPAUnder the California Consumer Privacy Act we honor the rights to know, to delete and correct, to opt out of sale and sharing, and to non-discrimination.
• PIPA (Korea)Under Korea's Personal Information Protection Act we publish our processors and international transfers and have a designated Privacy Officer.
• APPI · PDPAUsers in Japan and Singapore can request disclosure, correction, suspension of use and withdrawal of consent as those laws provide.