Security is built into the product from the database up. Here is what we do to protect your data.
Every workspace is isolated at the database level. Row-Level Security (RLS) policies ensure no user can read or write data from another workspace, whether through the UI, API, or MCP tools.
All traffic between your browser and our servers is encrypted with TLS. Data at rest is encrypted by the hosting provider.
Commitment confirmation, delivery verification, and all status transitions require authorized human action. Neither the browser, the API, nor an MCP-connected AI agent can bypass these checks.
We never scrape company-wide messages. Users paste meeting notes voluntarily. Private workspace content is never sent to an external model without explicit opt-in.
Every status-changing action records the actor, timestamp, previous and new values, and provenance (web app or MCP agent). Nothing changes silently.
We do not use tracking cookies, analytics pixels, or third-party advertising scripts. No cookie banner is needed.