trust and security

Controls you can check, not adjectives

This product sells the distinction between a checked claim and an asserted one. It would be incoherent to describe our own security any other way, so every statement below is drawn from the running system.

EU residency

in place

Database, authentication and file storage in Stockholm. One region, and no path by which content is copied out of it.

Tenant isolation

in place

Enforced in the database by row-level policy, and asserted on every run by more than 180 automated checks against a real instance.

Roles in the database

in place

Owner, editor and viewer are policies, not hidden buttons. Twelve of those checks exist to hold the line between them.

Append-only audit trail

in place

Every release and generation is recorded. Nobody can edit or delete a record afterwards — not the account owner, and not us.

No analytics vendor, no error reporting service, no session recorder and no advertising network — on this site or in the product. That is why there is no cookie banner, and the privacy notice lists every key of browser storage by name so you can verify it.

Where your data lives

One region, and a short list of what leaves it

RegionThe European Union. Database, authentication and file storage all sit in Stockholm, and there is no second region for content to move to.
The websiteA static bundle on a CDN. It holds no customer data, sets no analytics cookie, and loads no third-party script.
No middle tierThere is no application server of ours between your browser and the database. Nothing we operate holds a copy of your content in transit, because there is nothing to hold it.
What leavesOnly the AI features. Deck generation, brand-guideline reading, AI compliance review and claim research send text to a model provider that may sit outside the EEA. Carousels, brand kits, uploaded images and governance records never do.

Encryption

In transitHTTPS everywhere. Strict-Transport-Security is set at the edge with a two-year max-age, includeSubDomains, and preload. Database and storage connections are TLS.
At restProvided by the managed database and object-storage platform underneath. We operate no disks of our own and hold no keys of our own — if that distinction matters to your assessment, take the answer as the platform’s rather than ours.
PasswordsNone to encrypt. Sign-in is a one-time link to your email address, so there is no password stored, reused, or available to leak.

Tenant isolation

How one customer is kept out of another’s data

Every table carries row-level security keyed to account membership, and every policy routes through a single shared membership function rather than repeating the check table by table. One place to get isolation right is one place to get it wrong.

That is asserted rather than eyeballed. An automated suite runs more than 180 isolation checks against the real database, assuming the same role and identity claims the API assumes, inside a transaction that is always rolled back. Among what it covers:

8Reads: A member of one account cannot see another’s carousels, workspaces, projects, assets, account record, member list, or the brand-scoped grants held inside it.
4Writes: Cross-account insert of a post or a project is refused by policy; update and delete affect no rows.
6No membership: A signed-in user who belongs to no account sees nothing at all, on any of the six tables, rather than an empty state built in the interface.
16Audit records: The release record, the generation trail and the ledger of overrides are each asserted append-only — including that the account owner cannot rewrite their own release record, nor quietly clear the flag saying a rule was waived. A trail the audited party can rewrite is not a trail.
12Roles: A viewer cannot create, edit, delete or upload. An editor cannot invite, cannot promote themselves, cannot rename the account, and cannot weaken the house rules — through the column or through the guarded function.

What our staff can see

An administrator can run the business and not read your work

a platform administrator can read

Account names
Membership
Workspace names
Invitations
Release records
Generation audits

The information needed to run the business, and nothing beyond it.

and cannot read

Carousels
Projects
Uploaded assets
Templates

There is no policy granting it, which makes the restriction a property of the database rather than a promise about behaviour.

Administrator status cannot be granted from inside the product by an administrator. It is seeded out of band, which makes privilege escalation a deliberate act at the database rather than a click.

Access, roles and joining

Four seats, and every boundary is a database policy

Every no below is a refusal from the database rather than a button that was not rendered — which is what makes a viewer seat safe to hand to a client.

Capability	Owner	Editor	Viewer
Read everything in the account	yes	yes	yes
Read comments and sign-offs	yes	yes	yes
Write a comment or sign off	yes	yes	no
Create and edit content, upload assets	yes	yes	no
Release and export	yes	yes	no
Generate the compliance report	yes	yes	no
Invite people and change roles	yes	no	no
Set or weaken the house rules	yes	no	no
Rename the account	yes	no	no
Issue and revoke an API key	yes	no	no

The fourth seatLimited. No account-wide reach at all: it sees exactly the workspaces it holds a named grant on, and nothing else in the account. That is the seat for an outside consultant, or for a client who should reach their own brand and none of the others.
Reviewing without a seatA viewer reads; it cannot write a comment or record a sign-off, and the policies refuse both. Somebody outside the account who has to review and approve is given a review link instead, which reaches one post, expires, and can be revoked. That keeps a client reviewer out of your account entirely rather than inside it holding a role.
Sign-inA one-time link sent to the address on the account. No password, and no second factor beyond control of the mailbox.
JoiningInvite only. The token is 32 random bytes, single use, expires in fourteen days, and is bound to the invited address — redeeming it with a different account is refused.

SessionsHeld in the browser and refreshed automatically, so a working day does not get interrupted by a re-authentication prompt.
LeavingRemoval takes effect in the database the moment membership ends, rather than at the next sign-in.

Application security

The surfaces that face outward, and what each refuses

SecretsThe browser bundle carries only the public key, which every row-level policy above applies to. The keys that bypass those policies, and the model-provider key, exist only inside server-side functions and are never built into anything a visitor downloads.
Response headersnosniff, frame-ancestors denied, strict-origin-when-cross-origin referrer policy, camera, microphone, geolocation and topics all denied, and HSTS preloaded.
UploadsAn allow-list of image types, an 8 MB cap on images and 3 MB on fonts, into a private bucket. Nothing is public: files are served through signed URLs that expire in an hour, and the path prefix is the authorisation key.

Fetching your siteBrand import reads a URL you give it, which is a server-side fetch and therefore a real attack surface, so it is treated as one. Non-HTTP schemes, private and link-local addresses, intranet names, unbounded bodies and redirect chains are all refused, and the residual limits of that defence are written into the code and answered in the questionnaire below.
DependenciesEleven runtime packages. Adding one is treated as a decision rather than a convenience, and the same rule applies to sub-processors: two features that would have been trivial with an external service were written in-house to avoid adding a name to the sub-processor list.
TestsMore than 800 automated tests on the compliance and rendering logic, plus the database isolation suite. Both run before anything ships.

Logging and the audit trail

A record the audited party cannot rewrite

every release writes

The person who published
The exact wording they acknowledged
A fingerprint of the content
The rules as they stood at that moment
A written reason for anything waived

Generation runs write the equivalent. An owner can export the whole thing as JSON for any period, without asking us for it.

Retention, deletion and exit

RetentionContent is kept until you delete it. Nothing expires on you, and nothing disappears because a schedule somewhere decided it should.
DeletionDeleting an account cascades to its workspaces, and deleting a workspace cascades to its projects, carousels, assets and generation records. Release records survive the deletion of an individual carousel by design — their whole purpose is to evidence what was published.
Getting outArtwork exports as PNG and PDF, and the compliance report exports as JSON. Nothing you make is held in a format only we can read, which is the answer to what happens if we stop.
BackupsRun by the managed database platform under our plan. Ask and you will get the plan’s actual figures rather than a recovery objective invented for a web page.

Both tables are insert-only under policy. Nobody — including the account owner, including us — can edit or delete a record after the fact. That is what makes it worth handing to a client.

AI, and what it is allowed to touch

Four buttons are the entire outbound path

Deck generation

Brand-guideline reading

AI compliance review

Claim research

Each is a button a person presses, none runs on save or at export, and the specific model is written into the record for each action — so “which model saw this content” is answerable for a named piece of work rather than in general. We do not train on your content.

Five rule types are decided in code and call nothing at all. Four need judgement rather than arithmetic, and every release record states whether that review ran on that release: a rule the reviewer did not reach is recorded as steered and is never counted as passed.

If your policy requires that nothing leaves the EEA at all, that is available today. The deterministic engine runs in code, in your browser, and the four features above are the only outbound path. Sub-processor list →

The questionnaire, answered in advance

49 questions, before anyone sends a spreadsheet

Search this page for the term your template uses; the answers are written to be pasted straight into it.

in place: A control that exists and can be checked
no: A boundary of the product
ask us: Depends on your contract or configuration, and is settled in a conversation

Data protection · 9

Where is customer data stored?
in placeThe European Union — Stockholm. Database, authentication and file storage. One region only.
Is any personal data transferred outside the EEA?
ask usThrough the four features that call a model: deck generation, brand-guideline reading, AI compliance review and claim research. Claim research additionally routes through a web search plugin, so the claim text reaches a search provider. Brand kits, uploads and governance records never leave.
Can we run the product without any transfer outside the EEA?
in placeYes. The compliance engine, the editor, export and the release record are all local or in-region. The generation features are the only outbound path and nothing forces you to use them.
Do you use customer content to train models?
in placeNo. Content sent for generation is sent for that single request.
Is there behavioural tracking, analytics or advertising?
in placeNone at all, on the website or in the product — not even a session cookie. Sign-in state is held in localStorage. That is why there is no cookie banner, and /legal/privacy lists every key we store.
Do you sell or share personal data?
in placeNo.
Is a data processing agreement available?
in placeYes, published at /legal/dpa rather than sent after a call, and written from what the software actually does. If your counsel needs redlines, or your own paper, that is a conversation.
Can you choose a US or UK region?
noNo. There is one instance and it is in the EU.
How do you handle a data subject access or erasure request?
ask usHandled by us on request, within the statutory month. Everything is keyed to a workspace, so locating one person’s data is quick; the erasure itself is done by us rather than through a self-service screen.

Hosting and infrastructure · 7

Who are your hosting providers?
in placeA managed database, authentication, storage and functions platform in Stockholm, and a static-site CDN for the website. Both are named in full on the sub-processor list at /legal/subprocessors.
Do you operate application servers that process customer data?
in placeNo. The product is a browser application talking directly to the managed platform. Server-side code exists only as small functions that hold the keys the browser must not see.
Is data encrypted in transit?
in placeYes. HTTPS throughout, HSTS preloaded with a two-year max-age and includeSubDomains, TLS to the database and storage.
Is data encrypted at rest?
in placeYes, by the managed platform. We do not run our own storage and we do not manage our own keys.
What is your backup schedule and retention?
ask usRun by the database platform under our plan. Ask and you will get that plan’s actual figures, rather than a recovery objective written for a web page.
Do you offer an uptime SLA?
noNo. The service is provided as-is under the published terms. An availability commitment is agreed in writing with the customers who need one.
What happens to our data if you shut down?
in placeEverything you make exports in formats you already own: PNG, PDF, and the full compliance record as JSON. No proprietary container.

Access control · 14

How do users authenticate?
in placeA one-time link to their email address, or a Google or Microsoft account. No password is stored either way.
Do you support SAML or OIDC single sign-on?
noNo. Google and Microsoft sign-in exist, and both are OIDC underneath, but neither is single sign-on in the sense you are asking about: your directory does not govern access, there is no SAML connection, and sign-in cannot be restricted to your identity provider.
Do you support SCIM provisioning?
noNo.
Is multi-factor authentication available?
noNone that we enforce. Someone signing in with Google or Microsoft inherits whatever second factor your tenant requires, but that is your control operating, not ours, and it is optional: the email link stays available, so a user can always route around it. If your identity provider needs to be the control, that is single sign-on — see the answer above.
What roles exist and what can each do?
in placeOwner, editor, viewer and limited. Owners manage people and house rules; editors make and release content; viewers read. Those three reach every brand in the account. A limited seat reaches none of them by itself and sees only the brands it is granted, one at a time — the seat for an outside consultant. No seat, including viewer, can write a comment or record a sign-off — somebody who has to review and approve is given a review link rather than a role. Each boundary is a database policy with a test behind it.
Is authorisation enforced in the interface or in the database?
in placeThe database. Row-level security on every table, keyed to account membership through one shared function.
How do you prevent one tenant reaching another tenant’s data?
in placeThe same policies, asserted by more than 180 automated checks against a real database on every run — reads, writes, member enumeration, unaffiliated users, audit records, role enforcement, review links and brand-scoped access.
Can content be reached by someone with no account at all?
in placeYes, and only one way: a review link, created deliberately by someone who can already edit the post. It is how a client or a medical reviewer comments without being given a seat. Nothing else in the product is reachable without signing in.
What can a review link reach, and for how long?
in placeOne post. There is deliberately no brand-level or campaign-level link, so the blast radius of a forwarded link is a single piece of content and never a client. An expiry is required — the column is not nullable, so a link that never expires cannot be created — and any editor can revoke one before then. The link grants viewing and commenting; it can never edit, export, or see anything else in the account.
What do you store when a review link is created?
in placeA SHA-256 of the token and its first eight characters. The token itself is never written down, so it exists only in the URL the creator sends. We cannot recover one, which also means nobody reaching our database can use one. Every open is recorded against the link.
Can your employees read our content?
in placeA platform administrator can read account, brand, member, invitation and release metadata. They cannot read carousels, projects, uploaded assets or templates — no policy grants it. Administrator status cannot be self-granted from within the product.
How are users added and removed?
ask usAdded by single-use invitation bound to the invited address, expiring in fourteen days. Removal takes effect in the database the moment membership ends, and is done by asking us rather than from the account screen.
Are there session timeouts or forced re-authentication?
noSessions persist and refresh automatically. Neither is configurable.
Are there IP allow-lists or device restrictions?
noNo.

Application security · 9

Where do secrets live?
in placeThe browser receives only the public key that every row-level policy applies to. The policy-bypassing key and the model-provider key exist only server-side and are never bundled.
Which security headers do you set?
in placeX-Content-Type-Options nosniff, X-Frame-Options DENY, Referrer-Policy strict-origin-when-cross-origin, a Permissions-Policy denying camera, microphone, geolocation and topics, and HSTS with preload.
How are file uploads handled?
in placeAllow-listed image types into a private bucket, 8 MB per image and 3 MB per font, served only through signed URLs that expire in an hour. The path prefix is the authorisation key.
Does the system fetch URLs supplied by users?
in placeYes, for brand import. It refuses non-HTTP schemes, private and link-local addresses, intranet names, unbounded response bodies and redirect chains. It does not defeat DNS rebinding, and that limitation is documented in the code.
Have you had an independent penetration test?
noNo. You are welcome to run one against a test account.
Do you have a published vulnerability disclosure policy?
in placeYes — see /legal/security. It names the reporting address, the response times you can hold us to, what is in and out of scope, and a safe harbour for good-faith research.
How do you manage third-party dependencies?
in placeBy having few. Eleven runtime packages, and two features that would have been easy with an external service were written in-house rather than add a sub-processor.
Is there automated testing before release?
in placeMore than 800 tests on the compliance and rendering logic, plus the database isolation suite.
Is there an audit log, and can it be tampered with?
in placeEvery release and every generation is recorded with the person, the acknowledgement, a content fingerprint and the rules in force. Both tables are insert-only under policy — the account owner cannot edit or delete their own records, and neither can we.

AI · 4

Which parts of the product call a model?
in placeDeck generation, brand-guideline reading, AI compliance review and claim research. The deterministic half of the compliance engine is code and calls nothing.
How do we know whether AI review actually ran on a given release?
in placeThe release record states it, per release. A rule the reviewer did not reach is recorded as steered rather than counted as passed, so the answer is a field you can read rather than an assumption you have to make.
Which model is used, and can we know for a specific piece of content?
in placeThe model is recorded against each generation and each release, so the question is answerable for a named piece of work. The current default will be named on request.
Does the product guarantee compliance?
in placeNo, and it says so in the interface, in the terms, and in every release record. Deterministic checks are facts; model-assisted ones are probabilistic and will miss things; rules that only reached a prompt were never inspected. Each finding states which of the three it is.

Assurance and commercial · 6

Do you hold SOC 2, ISO 27001, or Cyber Essentials?
noNo. What we offer instead is evidence rather than assurance: isolation enforced in the database and asserted by automated checks on every run, least-privilege administrator policies we will describe table by table, and an audit trail nobody can edit.
Will you complete our security questionnaire?
in placeYes. This page is most of it already.
Do you have a documented incident response process?
noNo runbook. The statutory obligation to notify you of a personal-data breach without undue delay stands regardless.
Will you notify us before adding a sub-processor?
in placeYes, and the current list is published.
What are the commercial terms?
ask usPricing is published at /pricing. Access is by invitation rather than checkout, nothing is charged until an account is set up and you have used it, and purchase orders and invoicing are arranged directly.
What is the governing law and liability position?
in placeSwedish law. During the beta liability is limited to fees paid in the preceding twelve months, which is currently zero. That is a real limitation and your procurement team should read it as one.

Send us the rest of the spreadsheet.

If your assessment has questions this page did not answer, send it. You will get the same treatment as above: a specific answer, traceable to something you could check. Attach it to the invite request or reply to whoever sent you this link.

How to evaluate this in fifteen minutes Data processing terms