Security and trust
What is true today, and what is not yet.
Regulated buyers ask the same questions first. Here are straight answers, each labelled Today or Target. A label changes only when the thing is true, and the change is dated.
13
items true today
15
targets, not yet true
Last updated 13 October 2026
Can the assistant act on its own?
No. SIVA, the Sales Intelligence Virtual Assistant, proposes; a person approves. These are the rules it runs under.
| Control | Status | What it means |
|---|---|---|
| Approval before any send | Today | SIVA drafts; a person sends. Scheduled sends go out only after a person queues them. There is no auto-send setting to switch on. |
| Outreach actions logged | Today | Every outreach action is logged per workspace, with the person who took it. |
| Every assistant action logged | Target | A log of everything the assistant does, including its answers and searches, with who asked. |
| Reasons come with their source | Today | Company facts show where they were found. If nothing is found, the card says so instead of filling the gap. |
| Guessed emails are labelled | Today | An address the system inferred is marked “Guess — verify before sending”, and sending is blocked until it is verified or you enter it yourself. |
| 10-second undo on connected mailboxes | Target | A sent message is held for 10 seconds so it can be cancelled. Today you send from your own mailbox. |
| Customer data not used to train AI models | Target | We will publish the written commitment before we claim it. |
Who can see and change what?
Roles, approvals and how people sign in.
| Control | Status | What it means |
|---|---|---|
| Role-based access | Today | Roles decide who can see and change what. Salespeople see their own work; managers see coverage and targets for their team. |
| A second person approves usage corrections and higher spending limits | Today | The person who proposes a usage correction, or a higher spending limit, cannot approve it. |
| Separation of duties for every administrative change | Target | The person who requests any administrative change cannot approve it, and emergency access is kept in a permanent log. |
| Two-step sign-in | Today | Available for every account, and checked at each sign-in once it is turned on. |
| Two-step sign-in required for administrators | Target | Administrative accounts cannot sign in without it. |
| Single sign-on (SAML / OIDC) | Target | Sign in through your company's identity provider. |
| Passkeys by default | Target · 2027 | Phishing-resistant sign-in for every user. |
How is customer data protected?
How customer data is separated, protected and removed.
| Control | Status | What it means |
|---|---|---|
| Workspace isolation | Today | Each customer's data is kept apart: every request is limited to the signed-in customer's own workspace. |
| A second, independent isolation layer | Target | Separation enforced again where the data is stored, not only when it is requested. |
| Encryption in transit | Today | Every connection to the product is encrypted (HTTPS only). |
| Sensitive fields encrypted on their own | Today | Sign-in secrets, contact personal details and private notes are each encrypted, private notes with a key per customer. |
| Encryption at rest | Today | Stored data is encrypted at rest by our hosting provider's default. |
| Retention agreed per customer | Target | Retention periods are configured per customer, and deletion on request is confirmed in writing. |
Where is my data stored?
Today, in the United States. In-region hosting, starting with the UAE, is a target with no date set yet.
TodayUnited StatesThe product, its data and its backups.
Target · date not yet setYour regionUAE first, then each customer's region where required by law or by agreement. No date is set yet.
Some sectors require data to stay in-country — UAE banks, for example. Until in-region hosting is live, we say so before any pilot starts.
Has it been independently audited?
Not yet. No audit report exists. These are the artefacts we are working towards.
| Item | Status | What it means |
|---|---|---|
| Accessibility checks on every change | Today | Automated accessibility checks (WCAG 2.1 AA) on our main screens before each release. Not yet a full conformance claim. |
| Independent penetration test | Target | Summary letter shared under NDA. |
| SOC 2 Type II | Target | Report under NDA; a public SOC 3 summary. No report exists yet. |
| ISO/IEC 27001 | Target | Certification roadmap, with scope published when set. No certificate exists yet. |
| Data-protection mapping | Target | UAE PDPL and GDPR mapped with counsel, plus sector rules where a customer needs them. |
| WCAG 2.2 AA statement | Target | A published conformance statement for the product and this site. |
What we never do
Some things are rules, not settings.
- Send, reply or follow up without a person's tap.
- Show a guessed email address as a found one.
- Fill an empty field with an invented fact.
- Sell or share one customer's data with another.
- Present a target as something that is already true.
- Give the assistant a face, a character or a first person.
Ask for the security pack
The sub-processor list, this page as a signed document, and answers to your questionnaire. Ask through the demo form; a person replies.
Request the packSee your own market in it.
A 30-minute call, set up around how your team sells. Or try the ten-step demo now — no form.