Your workspace data lives in its own database deployment, not in tables shared with other customers. A shared control plane holds only what's needed to route requests: account identity, which data store is yours, entitlements, and usage and billing records. File storage is shared, with a separate folder for each account.

• All traffic uses TLS, and browsers are told to connect over HTTPS only.
• File storage is encrypted at rest.
• The tokens that let us read from services you connect are sealed with AES-256-GCM.
• Searchable workspace content doesn't yet have application-level encryption; it's planned.

• Sign-in runs through our identity provider, WorkOS.
• For a sign-in protected by a second factor, use a passkey, single sign-on, or a work account whose provider enforces two-step verification.
• Two-factor authentication is required for administrator accounts and accounts in HIPAA mode, and optional for everyone else.

• Standard sessions end after 7 days without activity or 30 days in total.
• Administrator and HIPAA-mode sessions end after 15 minutes without activity or 12 hours in total.
• Settings, Account has Sign out everywhere to end every session at once.

We use each AI provider's business API. Under those terms, providers don't use API data to train their models by default. Every provider is named on our subprocessor list.

Email jonathan@smartmanager.ai with the subject "Security report". We aim to acknowledge within 3 business days. Our full responsible disclosure policy and security.txt have the details.

Our Security page lists every control with its real status, including what is still in progress.