Security & privacy
Designed with security and privacy controls
What follows is what the product actually does. We do not claim certifications we do not hold.
Credentials encrypted at rest
OAuth tokens, provider API keys and webhook secrets are encrypted with AES-256-GCM. Ciphertext is bound to its context, so a credential row cannot be moved between tenants and still decrypt.
Secrets never return to the browser
Once saved, an API key can only ever be replaced — never read back. The interface shows the last four characters so you can tell which key is stored.
Tenant isolation in the query layer
Every query is scoped by organization, and brand-scoped members are additionally restricted to the brands they were granted. A tenant id supplied by the client is never trusted on its own.
Human approval by default
Nothing is published without a person approving it and publishing it. Automatic publishing is off by default, gated by a separate deployment-level flag, and never applies to high-risk conversations.
Server-side URL protection
Every URL the product fetches is resolved and checked before the request. Private ranges, loopback and cloud metadata endpoints are refused, and every redirect hop is re-validated.
Self-hostable
The whole platform runs on a single Linux VPS with Docker Compose. Your data, your infrastructure, your choice of AI provider — including zero-retention routing where the provider supports it.
How your data is handled
Third-party content
Content collected from public platforms is retained according to each source’s own policy — full text where permitted, an excerpt where not, and metadata only where that is all we may keep. The interface tells you which applies and why.
Your own knowledge
Documents you upload and claims you approve belong to you. They are used to ground responses for your brand and nothing else. They are never shared between tenants.
AI processing
Conversation text is sent to the AI provider you configure. Where the provider supports it, you can restrict routing to endpoints that do not train on your data, or to zero-retention endpoints — enforced through the provider’s own controls, not just a label in our interface.
Model training
We do not fine-tune models on third-party forum content. Your approved responses are stored as style examples for your own brand and are not used to train external models.
Platform conduct
This product is built to be used by brands that care how they are seen. That constrains what it will do:
- Official APIs and OAuth only — we never ask for your platform passwords.
- No scraping designed to work around missing API access.
- Rate limits and robots.txt are respected, not circumvented.
- No fake accounts, no sock puppets, no automated voting.
- No generated reviews or manufactured endorsements.
- Affiliation disclosed where the community expects it.
- The browser extension never submits a form on your behalf.
On compliance certifications
We describe the controls that exist in the product. We do not claim SOC 2, ISO or GDPR certification, because claiming a certification you do not hold is exactly the kind of unsupported assertion this product is built to prevent. If your deployment holds certifications, that is yours to state.