Security

Short version of how we protect what you give us

What we do

Data travels over HTTPS and sits on access-restricted servers hosted by DigitalOcean.
API keys, sign-in codes, session tokens and device identifiers are stored as hashes, not in plain text. Sign-in codes expire after 10 minutes.
Keys for our own service providers stay on our servers and never reach your device.
Agents ask before they send a message, place a call or spend money.
Approvals can use Face ID or a passkey. We keep the public key and a record of each approval. Your face and fingerprint stay on your device.
Connections to YouTube, Twitch, Google and storage accounts are scoped to what the feature needs, and you can disconnect them at any time.
Our own database backups are kept for 30 days and then deleted.

What we do not claim

No system is perfectly secure. Do not put anything in a shared room or a public room that you do not want the people there to see. If a breach affects your data, we will tell you without undue delay.

Who gets your data

The companies that process data for us are on the subprocessors page. What we collect and keep is in the Privacy Policy.

Report a security problem

Email jakemauldin@risingcreek.ai with what you found and how to reproduce it. Please give us a reasonable chance to fix it before you share it, and do not access data that is not yours.