Trust
What we do today to protect your data, and what we have not finished yet. Each statement below carries a status, and gaps are shown rather than left out.
How we protect your data
- In progressOur website tells browsers to connect to us only over secure connections. We have not yet confirmed, from our own deployment files, that every public address refuses unencrypted connections, so we do not mark this as complete.
- In progressStored documents rely on the standard encryption our cloud provider applies to its storage. Encryption with keys that we control ourselves is in progress and is not yet in place.
- DoneThe storage holding uploaded documents is set so that no document can be made publicly readable.
- DoneThe login details a customer gives us to connect a mailbox or messaging account are encrypted before they are stored.
- DoneCustomer passwords are stored only as salted one-way hashes, never as the password itself.
- DoneA sign-in session expires after 30 days, and the expiry is checked on our side, not only in the browser.
- DoneRepeated attempts to sign in, sign up or change an account are limited, to make password guessing harder.
- GapTwo-step sign-in is not available for customer accounts.
- In progressSupport access to a customer workspace goes through a dedicated tool. Each use is limited to one hour, needs a written reason, and is recorded in an audit log. Our wider internal access controls, including access to our cloud accounts, are still being tightened and reviewed.
- DoneA support session cannot download a customer's uploaded document files.
Where your data is stored
- DoneYour data is stored in Singapore (Google Cloud region asia-southeast1). It is not stored in Saudi Arabia.
Sub-processors
- In progressWe use the companies listed below to process data on our behalf. The list was built from a search of our own software on 2026-10-17. Where a company's processing region is not confirmed, we say so.
| Company | Purpose | Processing region |
|---|---|---|
| Google Cloud | Hosting, database, document storage and, when switched on for a deployment, document reading | Singapore (asia-southeast1) |
| Google Cloud (speech) | Speech-to-text and text-to-speech for meetings and calls | Not confirmed |
| Anthropic | AI language processing for our digital teammates (used when selected for a deployment) | Not confirmed |
| OpenAI | AI language processing for our digital teammates (used when selected for a deployment) | Not confirmed |
| Twilio | Phone calls and WhatsApp messages | Not confirmed |
| Google (mail connection) | Sending and reading email through Gmail, either a mailbox the customer chooses to connect or our own engagement mailbox | Not confirmed |
| Microsoft (mail connection) | Sending and reading email through an Outlook mailbox the customer chooses to connect | Not confirmed |
| Meta (WhatsApp) | WhatsApp messages, when switched on for a deployment instead of Twilio | Not confirmed |
| Outbound email provider (set per deployment) | Delivery of sign-in and notification emails | Not confirmed |
| Tavily | Web search for research tasks, when switched on for a deployment; search queries are sent to it | Not confirmed |
Your rights
- GapYou can download your documents one by one, disconnect a mailbox you connected, and delete individual notes. A self-service way to export all of your data, or to delete your account or workspace, is not yet available. To ask for a full copy, a correction or deletion of your data, contact us at the address below and we will handle the request by hand.
Not yet available. This has not been set up yet. Until it is, please use this contact instead: [SECURITY CONTACT EMAIL – owner to fill in]
Retention
- In progressEach uploaded document is given a retention date 365 days after it is saved. Nothing yet deletes a document when that date passes, and retention periods for other data are still being defined.
- DoneAccounts that were started but never confirmed by email are deleted automatically after 30 days, together with the data attached to them. Accounts that were confirmed are not deleted automatically.
Reporting a problem
- DoneSigned-in customers can raise a support request from within the service.
- GapA dedicated address for reporting a security problem has not been set up yet.
Not yet available. This has not been set up yet. Until it is, please use this contact instead: [SECURITY CONTACT EMAIL – owner to fill in]
Compliance status
- In progressSOC 2: preparing for an independent audit. No audit has been completed and no report has been issued.
- In progressGDPR: working towards. We have not completed the steps it requires, such as handling data requests within a set time.
- In progressSaudi Personal Data Protection Law (PDPL): working towards. Our data is stored outside Saudi Arabia, and we have not completed the steps the law requires.
Data processing agreement
- In progressA draft data processing agreement is available to download. It is a draft: a lawyer must review it before anyone signs it.
Download the draft agreementDraft only. A lawyer must review it before anyone signs it.
Last checked: