Who can see what you write, and where it goes.

These rules are enforced in how the software reads and writes data, not in a prompt.

• Blue (Life). Your conversations are yours alone. No other person has access to them.
• HeartWeave. Your private room is yours alone. The shared space is visible to the other members of your container, by design. The guide that helps a shared conversation is only ever given shared-space messages. Nothing you wrote in your private room is sent for a shared-space turn, and the safety layer runs under the same rule.
• Teams (Teal). Your conversations with Teal and the work profile it writes are private to you. Your organization, your team lead, and our own admin tools cannot read them. The lead sees only what you chose to send, and the Team Mirror, which is one page per team, identical for everyone, with no names on it.

The detail per product is in our Privacy Policy, Sections 10 and 11.

To answer you, a message is sent to a model vendor for that one request. The vendors are listed in Section 6, with what each receives. We call them directly, with no intermediary service in the path. Under the API terms we use, the model and transcription vendors do not train on your data.

Requests are logged on infrastructure we operate, so we can see costs and failures. Those logs never leave our systems.

All traffic to and from our services uses TLS 1.2 or higher. Your data is encrypted at rest, including backups.

Your database, files, voice recordings, and search index run on servers we operate ourselves. They are not stored in a shared multi-tenant service and are not handed to a third party to be indexed.

Secrets (API keys, third-party credentials, session tokens) are stored in a secrets manager and never written to source control, logs, or client-side code. Access to production data is limited to the people who operate the service, by role.

Sign-in is handled by Auth0, a SOC 2 Type II and ISO 27001 certified identity provider. We do not store your password, ever. Auth0 provides session management, MFA, and breach-credential detection.

Sessions use short-lived tokens. You stay signed in only when you opt in, and you can revoke a session at any time.

You can:

• Export your account data and conversation history. Ask at [email protected] and we respond within 30 days.
• Delete your data. In Blue, closing your account is reversible and permanent deletion happens on your request, not on a timer. In HeartWeave, deletion is in the app and takes effect immediately. In Teams, your data is deleted 30 days after your seat ends. The exact rules are in the Privacy Policy, Section 4.
• Revoke any connected service (Google Calendar, Apple Calendar, Todoist, Notion, Telegram, WhatsApp, Discord) in one click. The access token is destroyed on our side.

Every outside company that receives your data, by name. Per-product detail, including exactly what each receives, is in the Privacy Policy, Section 8.5. When we add one, this list changes with it and the date at the top moves.

Everything not listed here (database, file storage, search, request logging) runs on infrastructure we operate.

We build to the SOC 2 standard. The controls on this page are modeled on its Trust Services Criteria: encryption in transit and at rest, role-based access to production, a named vendor list we keep current, a security review we act on, and an incident process with a 72-hour notice commitment.

A SOC 2 audit is on our roadmap, and we intend to complete one, with the yearly audits that follow. If your organization needs a report or a completed security questionnaire now, write to [email protected] and we will work through your requirements with you directly.

• Where a vendor above publishes a certification, such as Auth0 or Stripe, we rely on it. We do not claim one on a vendor's behalf where they have not published it.
• We operate in line with GDPR and CCPA/CPRA. Data-subject requests (access, correction, deletion, portability) are honored within 30 days.

We run continuous monitoring on our services with Sentry and infrastructure-level alerting. If we confirm a security incident that affects your data, we will:

• Notify affected users within 72 hours of confirmation.
• Publish a post-incident write-up describing scope, root cause, and remediation.
• Coordinate with regulators where applicable.

If you've found a vulnerability in our products or infrastructure, we want to hear from you.

We don't yet run a paid bug bounty, but we take reports seriously and will reach out directly to researchers who meaningfully help us.

Documents for security and procurement review:

• Teams Customer Agreement: what the organization buys, what it can and cannot see, ownership, liability.
• Data Processing Addendum: roles, subprocessors, incident notice, transfers, deletion at end of term.
• This page, for the security overview. Questions that a vendor questionnaire needs answered go to [email protected].

For security or privacy questions that aren't a vulnerability report, reach us at: