Security

Every employee carries an autonomy ceiling that is part of its configuration, not a line in a prompt it could be talked out of:

• Suggest — it proposes, and nothing leaves the workspace.
• Draft for approval — it prepares the work and parks it. A human approves before anything is sent or written.
• Auto — it acts within its assigned tool set, and every action is traced.

The ceiling is enforced by the runtime that executes the employee, so raising it is a deliberate decision you make in settings.

The AI Engineer is locked at draft-for-approval and cannot be raised. It opens pull requests and posts to Slack. It never merges and it never deploys.

Work that leaves your workspace parks in an approval queue and waits. You approve it in the app or straight from the Slack card, and we record who approved it alongside the run it belongs to. Rejections are recorded the same way, so there is always an answer to who signed off on a given message.

Outbound email sits under a daily send cap as well, defaulting to 50 messages a day. It is a deliberate brake on the failure mode every outbound team fears: a misconfigured campaign reaching a list before anyone notices.

Pause a workspace and it runs no further turns. Work in progress saves its state at the next step boundary, its continuation is held, and nothing new starts until you resume. Nothing is lost — when you resume, the employee picks up where it stopped.

Because employees act through other companies’ systems, an action already handed to an outside service completes on that service’s terms. Everything still under our control stops.

Each run records what the employee did, which tools it called, and what it produced, and the activity feed surfaces that trace. “Why did it send that?” is a question you answer by reading the record, not by guessing at a model’s reasoning.

Every tenant table enforces row-level security scoped by agency and workspace, so one customer’s data is not reachable from another customer’s session. This is enforced in the database itself rather than only in application code, and we treat it as the non-negotiable property of the system: an agency running outbound for many clients needs each client’s data to stay in its own workspace.

Server-side paths that run with elevated database privileges carry the tenant filter in the query itself, and we test isolation on every change as part of continuous integration, including the cross-agency case.

• In transit: TLS, with HTTP Strict Transport Security and a content security policy enforced at the application edge.
• At rest: encrypted by our database and hosting providers.
• Connector credentials: the OAuth tokens you grant us are encrypted with AES-256-GCM before storage, on top of the provider’s own encryption, and are never exposed to the browser.

Both of these are self-serve in Settings. Neither is a support ticket.

• Export. Download your workspace’s data — every table holding your content, not a curated subset. Credential tables are excluded by design; we do not hand encrypted secrets back in a download.
• Deletion. Delete your workspace yourself. It leaves the product immediately and is permanently purged after a 30-day grace period, so an accidental deletion is recoverable and an intended one genuinely completes.

Two things outlive a purge on purpose: the administrative audit log, which is what lets us answer security questions after the fact, and marketing contact records, which are governed by your marketing preferences rather than by your workspace.

We are model-agnostic and send your data to a model provider for inference only. We do not train our own models on your content, and we rely on our provider’s enterprise terms, under which inputs and outputs are not used to train theirs. Your intellectual property stays yours.

We use a deliberately small set of vendors to run the Service, each under contract: Anthropic for model inference, Supabase for database, authentication and storage, Vercel for hosting, Sentry for error monitoring and PostHog for product analytics. Email and enrichment providers are used only when you connect them, and only for the sends and lookups you initiate. The full list is in our Privacy Policy.

We do not hold a SOC 2 report. We build to equivalent controls and we will not claim an audit we have not completed. If your procurement process requires a finished SOC 2, tell us early and we will be straight with you about where we are.

Dependencies are kept patched, a clean vulnerability audit is a required check on every change we ship, and automated secret scanning runs against the codebase continuously.

If you find something, tell us at barmstrong@growthforce.io. We will acknowledge you, keep you updated as we investigate, and we will never pursue legal action over good-faith research that respects our customers’ data. While testing, please do not access, modify, or remove data belonging to anyone else.