Security
The unpublished half is the sensitive half.
Drafts you have not shipped, client notes, and the documents behind your thinking. This page describes the controls that are actually in place today.
Workspace isolation
Every table carrying your content is protected by row-level security scoped to workspace membership. A request for another workspace's rows returns nothing at the database layer, regardless of what the application asks for.
Authentication
Sign in with email and password or with Google. Sessions are managed by the hosted auth service; we never store your password.
Encrypted third-party credentials
Tokens for connected accounts are encrypted at rest with AES-256-GCM and only decrypted server-side at the moment they are used. They are never sent to the browser.
Explicit confirmation for outbound actions
Publishing a post and sending a reply both require you to confirm. The product does not act on your LinkedIn account on its own.
Untrusted content handling
Documents, URLs and research results are treated as data for the model to reason about, never as instructions. Text inside an uploaded file cannot redirect the system's behaviour.
Audit logging
Generation, edits, approvals and publishes are recorded per workspace so there is a reviewable history of who did what.
Rate limiting and abuse controls
Public endpoints, including the anonymous voice demo, are rate limited per address. The demo does not persist anything you paste into it.
Data export and deletion
You can export your drafts, knowledge base and voice profile at any time, and deleting your account removes your content.
Scope
What this page is, and is not.
This is a description of the controls we operate, maintained by us. It is not an independent audit, and it does not claim any certification. We do not currently hold SOC 2, ISO 27001 or equivalent attestations, and we would rather say so than imply otherwise.
Responsibility is shared. We secure the platform, isolation and credential handling. You control who you invite into your workspaces, what material you upload, and what you choose to publish.
If you are evaluating us for an organisation with a formal security review, get in touch and we will work through your questionnaire directly.
Reporting
Found something? Tell us.
If you believe you have found a vulnerability, report it through the contact page with enough detail to reproduce it. We will acknowledge the report and keep you updated while we investigate.
Please do not test against other people's accounts or data while researching. Use your own workspace.
See how close it gets on your first try.
Paste a couple of posts you have already written. You will know within a minute whether this sounds like you.