Trust Center
everything holds your email, calls, and customer records, so security is part of the product. This page covers where we stand on compliance, the controls running in production today, and how to get anything else your review needs.
Compliance
SOC 2 Type IIn progress
Controls are being put in place ahead of an independent audit.
SOC 2 Type IIPlanned
Follows Type I, after a monitored observation period.
ISO 27001Planned
Built on the same controls as SOC 2.
Security controls
Infrastructure
- Hosted on Google Cloud Run in the United States, with the database on Supabase.
- All traffic is encrypted with TLS, and browsers are told to use HTTPS only (HSTS).
- Production secrets live in the cloud environment, never in source code.
Data protection
- Data is encrypted at rest by our hosting providers.
- Integration credentials and saved secrets are additionally encrypted with AES-256-GCM before they are stored.
- Workspaces are isolated from each other by database row-level security.
- Customer data is not used to train AI models.
Access control
- Staff access to internal tools requires two-factor authentication.
- Admin tools are restricted to named staff accounts.
- Changes to records are written to an audit log.
Application security
- LinkedIn, X, Reddit and WhatsApp traffic runs through your own browser, never from our servers.
- Dependencies are monitored for known vulnerabilities, with update alerts raised automatically.
- Google user data is handled under the Google API Services User Data Policy, including its Limited Use rules.
Your data, your control
- You can delete your account and its data yourself, from settings.
- Deleted data leaves production within 30 days and backups within 90 days.
- Disconnecting an integration revokes our access to it straight away.
Documents
Privacy policyWhat we collect and whyTerms of serviceThe agreement for using everythingSubprocessors20 providers, updated October 26, 2026
Security policiesAvailable on request under NDA
Security questionnaireWe complete yours, or send our standard answers
Security questions or a vendor review?
Email security@thetool.company for policies, questionnaires, or a call with our team. To report a vulnerability, use the same address. We reply within one business day.