Encryption and workspace separation

Each workspace has its own encryption key, and every request is limited to your own workspace.

What is encrypted

• Sensitive fields, with AES-256-GCM and a key derived separately for each workspace. Examples: briefs, meeting prep, follow-ups, memories, tasks and the items waiting in Decisions.
• Data Room files, with the same per-workspace key. A file read with another workspace's key fails.
• Connection secrets: the sign-in tokens and API keys for the tools you connect.
• In transit: the app and the website are served over HTTPS.

Not every column in the database is encrypted. The per-workspace encryption covers sensitive fields and Data Room files.

How workspaces are kept apart

• Every query is limited to your workspace in the application, and row-level security policies keyed to your workspace are enabled in the database.
• Asking for a record from another workspace returns "not found", so it does not even confirm that the record exists.
• Inside your workspace, the owner controls connections, the built-in automations and the data settings.

Where your data is stored: Your data and the EU. What we can show you about security: the Trust page.