A customer program is built on trust: your members trust you with their time and their candour, and you trust us with both. This page explains, in plain terms, where your data lives, who can reach it, how sign in works, and what you and your members control. If anything here raises a question, write to [email protected].
Where your data lives
Application data is stored in Google Cloud, in Firestore, with files such as logos and documents in Cloud Storage. The API runs on Google Cloud Run and the web apps are served by Vercel. Google encrypts data at rest by default, and every connection between your browser, the apps and the API uses TLS.
One organization, one boundary
Every record belongs to exactly one organization and is stored under it. Every request to the API is checked against the caller's organization before anything is read or written, and a query that could reach across organizations is treated as a defect: our test suite includes dedicated isolation tests that fail if one appears. Browsers and mobile apps never talk to the database directly; the database's own rules deny it, so the API is the single place authorization happens.
Signing in
Accounts use Firebase Authentication. Your team signs in with an emailed link or with Google; passwords are optional, so most accounts have none to leak. Members sign in with an emailed link to their community's own address. Team roles are admin and viewer, and only the organization's owner can delete the organization or transfer ownership. From Settings, a team member can see their current session and sign out of every device, which revokes all of their tokens at once. Two-factor authentication is not available yet.
Your members' own address
Each community is served at its own subdomain, and a member's session belongs to that address alone. A member who lands on another community's address sees nothing of it. Team members can only preview their own portal.
Integrations
- Zoom. Connected at the organization level through Zoom's OAuth flow; we never see a password. The refresh token is kept in Google Secret Manager, not in our database. A meeting is created only when you choose that when publishing, and cancelling the engagement deletes it. Members receive the join link only. The host start link never leaves the admin app: it is not shown in the portal, in emails, or in any member-facing response, and we test for that.
- Email. Invitations, reminders and recaps are sent through Resend from a dedicated sending domain. Every outreach email carries an unsubscribe link and the one-click unsubscribe headers mail clients understand. A bounced or unsubscribed address is suppressed platform wide, whichever community holds it.
What members control
A member can download everything the platform holds about them as one machine-readable file, and can delete their account, which erases their personal details while keeping the sessions they took part in intact for the team. Members choose which emails they receive. The team's private notes about a member are not shown to the member.
What you control
The owner can delete the organization and everything under it. Admins manage who is on the team, who is in the community, and which integrations are connected. Everything an engagement shows to members is explicit in its portal entry; internal fields such as the objective, notes and attachments are never rendered to members.
How we work
- No key, secret or credential is ever written into code or committed. Server secrets reach the API only through its environment.
- Every input is validated against a shared schema at the API boundary before it is used.
- Public endpoints, such as invitation acceptance, sign in links and the waitlist, are rate limited per caller and per address.
- Email addresses are masked in logs, and logs carry identifiers rather than personal data or message content.
- Features that are not ready stay behind configuration flags rather than half-shipped.
Sub-processors
| Provider | Purpose | Data |
|---|---|---|
| Google Cloud | Database, file storage, authentication, the API, secrets | All application data |
| Vercel | Hosting the web apps and this site | Request logs |
| Resend | Sending email | Recipient addresses and message content |
| Zoom | Meetings, only when you connect it | Meeting topics, times and agendas |
Compliance
We are an early-stage company and have not yet completed a SOC 2 audit. We are building toward one and will publish the report here when it exists. For customers in the EU and UK we offer a data processing agreement on request. Our privacy policy covers this website; the product's own privacy notice is presented inside the product.
Reporting a vulnerability
If you believe you have found a security issue, email [email protected] with enough detail for us to reproduce it. We will acknowledge within two business days, keep you informed as we fix it, and credit you if you would like. Please give us a reasonable time to fix an issue before disclosing it, and do not access data that is not yours while testing. We do not run a paid bounty programme yet.