Cookies on this site

We use the cookies the site needs to work. With your consent we also remember which page or link first brought you here, so we know where the businesses who sign up come from. We do not use advertising or third-party tracking cookies. You can change your choice at any time with “Cookie settings” at the foot of the page. Read the cookie statement

Assistant Workshop
Sign in
Theme

Draft

A lawyer has not reviewed this text yet, and the fields in square brackets are still to be filled. It is published so you can read what the service will offer; it is not yet in force as written.

Security at Assistant Workshop

Version 2026-10-05

This page explains how we protect the data of the businesses that use Assistant Workshop and of their customers. The threat model and the security policy published with the source code name the code and the tests behind each measure.

1. Where the data lives

  • The service, its database and the language model it uses by default run in the European Union.
  • Providers outside the European Economic Area are used only for the functions named in the list of sub-processors (section 8 of the data processing agreement, published at /dpa).
  • Backups are encrypted before they leave the hosting provider and are kept for 30 days (daily copies) and 12 months (monthly copies).

2. Who can see a business's data

  • Every request for a business's data checks that the person belongs to that business, and the database keeps businesses apart with row-level security.
  • Platform staff open a client's cabinet only with a stated reason, for at most 60 minutes and read-only unless the owner allows changes; the owner sees a banner and the access is recorded in the audit log.
  • Platform administrators sign in with an authenticator app, and sensitive actions ask for the second factor again.

3. Signing in

  • Sign-in uses one-time codes sent by SMS, WhatsApp, Telegram or e-mail; each code allows a few attempts and is stored only as a hash.
  • Owners can add an authenticator app, see the devices they are signed in on and sign any of them out.
  • Sessions end after a period without activity and after a maximum lifetime.

4. Encryption

  • All traffic goes over HTTPS, and browsers are told to use nothing else (HSTS).
  • Messenger tokens and calendar access are encrypted in the database with keys that are rotated.
  • Call recordings are stored encrypted, with a separate key for each business.

5. The assistant

  • What customers write is treated as untrusted input; attempts to make the assistant ignore its rules are detected and slowed down.
  • Before a reply goes out, a guard checks prices, times and other facts against the business's own information and hands the conversation to a person when it cannot confirm them.
  • Tools such as booking take the business from the conversation, never from what the model writes.

6. Records and control

  • Views of customer data, exports, erasures, team changes and administrator actions are recorded in an audit log the owner can read.
  • Owners export their business's data and erase a customer's data in the settings, and personal data is deleted after the retention period the owner chooses.

7. How the service is built

  • Every change is checked automatically: tests, static analysis and scans of dependencies and secrets (CodeQL, bandit, pip-audit, npm audit, gitleaks, Trivy).
  • Third-party build steps are pinned to exact versions.

8. Reporting a vulnerability

Please report a security issue privately, as /.well-known/security.txt describes. We acknowledge a report within 2 business days, and we tell the affected clients about a personal data breach within 48 hours of becoming aware of it.