Security and data

What we access, and what we don't.

Nothing below is aspirational. It is how the product is built today.

Three Google connections, granted one at a time. None of them is required.

Calendar

auth/calendarRead and write

Creates one calendar of its own, writes your time blocks into it, and reads the calendars you pick so the week shows everything at once.

Stored

Time blocks on the calendar it created

Never stored

Events from your own calendars, which are read live and dropped

Contacts

auth/contactsRead and write

Two-way sync for the contacts you choose, so a follow-up cadence here does not mean keeping a second address book.

Stored

Name, email, phone, company, role, notes, birthday

Never stored

Any contact you did not choose to sync

Drive

auth/drive.fileOnly files it creates, plus files you hand it

Keeps company documents reachable from the workspace. This is the narrow Drive scope, not the one that can read everything you own.

Stored

The file id, nothing else

Never stored

File contents. Uploads and downloads stream through, unwritten

One thing we will not dress up

Calendar uses Google's broad calendar scope, not a narrower one, because creating and renaming a calendar of its own requires it. Drive is the opposite case and deliberately uses the narrow scope. We would rather tell you which is which than call all three least privilege.

A copy of the database opens none of your accounts.

Credentials

Every Google token and provider API key is encrypted with AES-256-GCM, with a fresh initialisation vector per value, before it reaches the database. The key that decrypts them lives only in the application environment.

Workspace data is isolated at the database level: every table carries a row-level policy tied to your account, so isolation does not depend on the application getting a query right.

Your payment provider keys

We ask for a scoped key: read your billing objects, and create the one webhook that keeps them fresh. It cannot charge your customers, issue refunds or move money.

Disconnecting disconnects, and leaves your work where it is.

Revoking access

Disconnecting revokes the token with Google itself, not just locally, and deletes the stored credentials. What has already synced stays yours, and files in your Drive are left exactly where they are.

Your data leaves as easily as it arrived.

Export and deletion

One request exports the whole workspace as JSON: customers, ledger, contacts, decisions, opportunities, planner, documents index and the company log. Customers also export as CSV. Both are buttons in Settings, not support tickets.

Deleting your account cascades through every table that belongs to it. Backups age out on their normal cycle afterwards.

Who else touches it

Vercel runs the app, Supabase holds the database and sign-in, Paddle is our Merchant of Record, and Google receives only what the integrations you connected require. Some of that infrastructure processes data in the United States. The service is operated from Germany under the GDPR.

There is no AI provider in that list: your workspace is not used to train anything. The workspace privacy policy names every processor, and the legal notice names the operator.

Connect nothing, and it still works.

Start 14-day free trial

No credit card required. Then $10/month if you stay.