Your data. Your control.
We take security seriously. Here is how we protect your information.
Strong encryption everywhere
Your data is encrypted in transit and at rest, so it stays protected on the wire and on disk at every layer of the platform.
Your account stays your account
Every account is strictly isolated from every other one. Your records, contacts, and conversations are never visible to another customer.
Built around GDPR principles
Export your data, request erasure, and move your records elsewhere whenever you choose. Privacy is built into how the product works, not bolted on.
A full audit trail
Every action is recorded with who did it, when, and what changed. The audit trail is available on the Business plan when you need to answer who-did-what.
Your AI prompts are never kept
Email drafts, smart replies, and summaries run under a zero-retention agreement enforced on every request. Prompts and results are never logged, never used to train models, and never reviewed by a person.
Connected accounts stay locked down
The access keys for Google and your other connected services are encrypted, stay on the server, and are immediately revoked the moment you disconnect.
Data handling
Storage
Your data is stored on encrypted servers in the United States. Infrastructure is hosted on major cloud providers operating under their own industry-standard security certifications and data processing agreements.
Backups
Daily automated backups with point-in-time recovery. Backups are encrypted the same way your live data is.
Data retention
Deletion runs on a published clock, measured from the moment the deletion is accepted: 30 days for a workspace deletion and 14 days for a user deletion, which removes a single account. Backups holding that data are purged within 90 days. A workspace can be given a longer window, up to 90 days, which we set on request, and a zero window with no cancellation period is used for abuse cases and legal takedowns. You can export all your data (contacts, companies, deals, activities) as CSV before closing your account.
Access ends when the deletion is accepted, not when the window closes. The cancellation window that follows is a recovery period: we send a notice by email carrying a link that shows the status of the deletion without signing in, and cancelling it is a separate step that requires signing in.
Once a deletion completes we keep one minimal suppression record, a one-way hash of the address plus the bare domain, retained for 13 months to stop the same address from opening repeated trial accounts. The address itself is released at that point, so the address can be used for a new account as soon as the deletion completes.
Compliance
GDPR
We follow GDPR data protection principles. You can request data export, data deletion, and data portability from your account settings. Our privacy policy details how we process and protect personal data.
Data processing
We process data only as needed to provide the service. We do not sell your data to third parties. Third-party sub-processors are vetted and bound by data processing agreements.
Responsible disclosure
Found a security vulnerability? We appreciate responsible disclosure. Please review our security policy before reporting.
View security.txtQuestions about security?
We are happy to answer any questions about how we protect your data.