Your data, handled like it matters
The four rules
Your records are stored in your accounts
Your files and records are stored in your own accounts. To do their work, automations send content to the services that process it, such as your AI provider and automation platform, and we list every one for you. If we part ways, everything keeps working.
Least-access permissions
Every connection gets the minimum access needed for its one job, such as reading one folder rather than your whole drive. You can see and revoke every permission.
Approval steps and activity logs
Money never moves and payment details never change without a person. Customer emails and deletions wait for a human to approve them until you decide otherwise. Every action lands in a log you can read.
Business AI plans that don't train on your data by default
We only use business or API plans from AI providers, set up in your company's name, never free or consumer plans. Their terms say your data isn't used to train models by default. We never sell data or keep copies we don't need.
Where your data lives
In your accounts
Your documents are stored in your Google Drive, Microsoft 365, or Dropbox, and customer records in your CRM. To do their work, automations send content to the services that process it, such as your AI provider and automation platform. We list every one for you in writing, and we don't keep copies of your files beyond what a project needs.
Who can access what
Each connection gets only the access its job needs. An automation that files documents can see its intake folder and its destination folders, and nothing else on your drive. We keep a written list of every permission we hold, and you get a copy.
How access is removed
You can revoke any permission in your own admin panel without asking us. When an engagement ends, we walk through the list together and remove anything no longer needed.
Approval steps and logs
Money never moves and payment details never change without a person doing it. Customer emails and deletions wait for a person until you decide otherwise. Every automated action is written to a log you can read without asking us.
What we never do
- Sell your data to anyone
- Use free or consumer AI plans. We only use business or API plans set up in your company's name, whose terms say your data isn't used for training by default
- Keep copies of your documents we don't need
- Hold your systems hostage. Everything we build is set up in accounts you own and keeps working if we part ways
- Hide what an automation did. Every action is logged, and every automation has an off switch you control
AI providers we use
We use only their business or API plans, set up in your company’s name, and never free or consumer plans. Their terms say your data isn’t used to train their models by default, and we never opt in. Providers may keep content briefly under those terms, for example up to 30 days for abuse monitoring. Which provider fits depends on the job. These are the ones we work with, each linked to the provider’s own page so you can check.
Anthropic (Claude for Work and the Claude API)
By default, Anthropic doesn't use inputs or outputs from its business products to train its models, unless you choose to share them, for example as feedback.
Read Anthropic's policy(opens in a new tab)OpenAI (ChatGPT Business, Enterprise, and the API)
By default, OpenAI doesn't use data from ChatGPT Business, Enterprise, or its API to train its models, unless the customer opts in.
Read OpenAI's policy(opens in a new tab)Google (Gemini in Google Workspace)
Google doesn't use Workspace customer data, including Gemini prompts and responses, to train its AI models without the customer's permission.
Read Google's policy(opens in a new tab)Microsoft (Copilot with a work account)
Microsoft doesn't use Copilot prompts, responses, or the business data Copilot reads through Microsoft Graph to train its foundation models.
Read Microsoft's policy(opens in a new tab)Questions to ask any AI vendor
Including us. A good vendor answers all seven without flinching.
- 1
Where does our data physically live, and in whose account?
- 2
Is our data used to train your models or anyone else's?
- 3
What exactly can your system access, and can we see the permission list?
- 4
When the automation makes a mistake, who catches it, and how?
- 5
Is there an activity log we can read without asking you?
- 6
Is there an off switch we control?
- 7
If we stop working with you, what keeps working and what do we lose?
Have a security question we didn't answer?
Ask it on the call. The founder answers security questions personally.