Your business data is sensitive: client emails, invoices, schedules. This page describes how we protect it. It reflects our program during the design partner phase, and we will update it as the program matures.
Our principles
Ask for the least access, keep every business separate, and log everything the AI does.
- Least privilege. PoweAI starts read-only. We ask for permission to draft or send only when you turn on features that need it.
- Isolation. Each business's data and Business Brain are logically separated from every other business.
- Transparency. Every action the AI takes is logged with its reason, and you can review it.
Protecting data
- Encryption in transit using TLS and encryption at rest.
- OAuth tokens and secrets stored encrypted and never exposed to the browser.
- Database access controls that limit each request to the business it belongs to.
- Backups with defined retention, and deletion processes for closed accounts and disconnected tools.
Access control
- Staff access to production systems is restricted to people who need it, protected by multi-factor authentication and logged.
- Staff do not read customer data except with permission, for security, or as required by law.
Google security assessment
Apps that use sensitive or restricted Google scopes, such as Gmail, must pass an annual security assessment by a Google-designated third party. We complete this assessment as required for the Google scopes PoweAI uses.
Vendors and AI providers
We review the security of the providers that process data for us, and we bind them to data protection terms. Our AI model providers may not train on your data. See the subprocessor list in our DPA.
Incident response
We monitor for suspicious activity, investigate alerts and follow an incident response plan. If an incident affects your personal information, we notify you within 72 hours of confirming it, as described in our DPA.
Certifications
PoweAI does not yet hold a SOC 2 report. We plan to pursue a SOC 2 Type I report by target date. We will update this page when it is available.
Report a vulnerability
If you believe you have found a security issue, email security@poweai.com with the details. Please give us reasonable time to fix it before disclosing it publicly, and do not access other customers' data. We will acknowledge your report within 3 business days.