Your data, handled like it belongs to someone you love.

Security measures, in plain English.

• Residency

  EU data residency

  Your conversations, contacts, and business data are stored exclusively in EU regions. We do not replicate or back up data outside the EU.

• Encryption

  Encrypted in transit and at rest

  TLS 1.2+ for every connection. AES-256 at rest. Database backups are encrypted with separate keys rotated on a defined schedule.

• Access

  Role-based access, least privilege

  Every action is gated by Row-Level Security policies. Operator and admin scopes are separated. Engineer access to production data is broker-only and logged.

• Infrastructure

  Hardened, managed infrastructure

  We run on Supabase (Postgres) and Cloudflare. Both providers are SOC 2 Type II and ISO 27001 certified. We inherit their physical, network, and platform controls.

• AI safety

  Your data never trains foreign models

  Model providers we use are contractually bound to not retain or train on your prompts and completions. Your conversations are not pooled with other tenants.

• Observability

  Full audit trail

  Every agent reply, tool call, and admin action is logged with actor, timestamp, and payload hash. You can export logs for your own compliance reviews.

• Compliance

  CASA Tier 2 & GDPR aligned

  We've completed the Cloud Application Security Assessment Tier 2 and operate under GDPR with a documented sub-processor list and a signed DPA on request.

• Incident response

  24-hour breach notification

  Defined runbooks for detection, containment, and notification. Customers affected by a confirmed incident are notified within 24 hours, well ahead of the GDPR 72-hour limit.