You’re handing us your contracts.

Every record we hold — a bill, an agreement, proof of work, a problem we found, a document, a line of your history — is stamped with the business that owns it.

We write that check out by hand at every single question we ask the database, rather than letting a framework add it invisibly. Something that adds the check for you is something that can quietly stop adding it. Written out, anyone reviewing the code can search for it and a test can insist on it.

Everything on the server goes through one gate that works out who you are and what you are allowed to see before it reads anything at all. There is no path that fetches a record first and asks who owns it afterwards.

All traffic runs over TLS. Plain HTTP requests are redirected, and the app is only reachable over HTTPS.

Data sitting at rest — the database and your uploaded documents alike — is encrypted by the platforms underneath us with AES-256.

Passwords and connection strings live in our hosting platform's encrypted store. They are not in the code, and they cannot be read from your browser.

Bills, proof of work, agreements, and receipts are the most sensitive things you hand us, so they are stored privately and are never publicly reachable. There is no address you could guess that would return one.

A document is only ever handed to someone signed in to the business that owns it, through a link made for that one request. The link expires, so a copied address stops working.

Deleting a document deletes the file itself, not just the row pointing at it.

There are seven roles — owner, approver, reviewer, site manager, buyer, leadership, and outside reviewer — and each one is tied to an explicit list of what it can do.

That list is short enough to read in one screen, and the settings page shows it word for word, so you can answer “what could she actually do?” without guessing. Paying a bill, saying a problem isn't real, and adding people are three separate permissions, each belonging to a different role.

An outside reviewer can only read, including on your history. Nobody gets a permission because it was convenient during a support call.

Every meaningful action — paying, deciding not to pay, dismissing a problem, changing a price, adding someone — is written down at the same moment as the change itself. If the change happened, so did the record of it.

Entries can only be added, never altered, and each one is sealed to the one before it. Nothing updates a past entry and nothing deletes one.

That is the whole point. Changing or removing something in the past breaks every entry after it, which makes tampering something you can spot rather than something we merely discourage — including tampering by whoever runs your workspace, and including by us.

It is your data. Problems, decisions, and your history can be downloaded for as long as you have an account.

We delete your documents and records when you ask. That means really deleting the files, not hiding them behind a flag, and it carries through to backups on the platforms' normal backup cycle.

If you close your account we do not hold on to your documents as a matter of course. Tell us what you want kept and for how long, and that is what happens.

Your bills, agreements, prices, company names, and the problems we find are never used to train or tune any model — ours or anyone else's. There is no box to untick, because there is no such use.

Where AI reads a messy document or writes an explanation, it works on your data to answer your question and nothing else. It never pays a bill, never gives a verdict without saying why, and never messages a company on its own.

What you have negotiated with the companies you buy from is the most confidential thing you have. It is not training material.