Your customers’ words, in your own database.
It reads support conversations for a living, so how they are handled is the product, not a policy page.
One database per workspace
Your conversations are not rows in a shared table beside another company's. A separate Postgres project, with separate credentials.
Redacted before the first write
Personal detail is stripped on arrival, not after storage. People are counted by a hash, so we can say nine people without holding nine identities.
Every action on the record
Append-only and hash-chained, including who approved what and the exact text that was sent. You can read it; nobody can quietly edit it.
Retention you set
A scheduled hard delete runs on your setting, across conversations and everything derived from them. Erasure for one person on request.
What we will not do
- Receiving signals from a system never authorizes acting on it — those are two separate permissions, and you grant them separately.
- No message reaches a customer without you approving the exact words.
- No training of shared models on your conversations.
- No per-agent scores, so there is nothing to leak about your team.
- No silent overwrite of your help center — an approval binds to one revision.
Who else touches the data
Key management and error tracking providers are being added; each is listed before it receives anything, and changes are announced before they take effect.