Security

This page states what is true today. It makes no certification claims.

Isolation between workspaces

Each workspace's data is separated by database row-level security rules. A member can only read the rows of workspaces they belong to, and private channels only to their members.

Encryption

Data is encrypted in transit and at rest by our cloud providers. API keys and bot tokens for connected accounts are encrypted with a separate key before they are stored.

Approval before actions

An assistant cannot take an action outside your workspace, such as sending an email or posting to another service, until a person approves it.

AI model routing

AI requests on the credits plan are routed only to providers with zero data retention.

Where your data lives

Workspace data is held in a Supabase database in the Asia-Pacific region. Uploaded files are held in Cloudflare R2. See the sub-processors list for every provider.

Deletion

Deleting a workspace removes its data from the database and file storage after an undo window.

Reporting a vulnerability

Write to the support address in the page footer, when one is shown. A dedicated security contact is set by the operator.