Security and privacy, stated plainly.
What we do to protect your workspace, what we keep and for how long, and where our compliance program actually stands — no certifications we don't hold.
How your data is protected
Workspace-scoped data
Workspace data carries a workspace ID and the application scopes every request to the workspace making it. Postgres row-level security policies exist on most tables and back this up on connections that use our restricted database role, but some server-side paths use a privileged connection that bypasses them, so application-layer scoping is the primary control.
Encrypted in transit
TLS on every connection to our apps and API. Customer-managed keys and single-tenant deployments are not offered today.
Role-based access
Every workspace has role-based permissions, and every write is checked against the caller's role in that workspace before it touches data.
Monitoring and incidents
Errors and alerts are monitored continuously. If an incident affects your data we tell you directly; we do not yet commit to a public response-time SLA.
Compliance status
We are not currently SOC 2, ISO 27001 or HIPAA certified. We honour GDPR data-subject rights for every user, wherever you are based — access, correction, erasure and portability — and respond within 30 days. GDPR is a regulation, not a certification, so we describe it as a commitment rather than an audit result. If a signed DPA, a security questionnaire or a specific framework is a requirement, email legal [at] amdital.com before you sign up. Our standard DPA template (subject to counsel review) is at /legal/dpa.
How long we keep data
| Data | Retention |
|---|---|
| Workspace and account data | Kept for the life of your subscription plus 30 days; deleted on request (manual process, email privacy@amdital.com) |
| Activity-monitoring logs | 90 days, deleted automatically |
| Web server and access logs | 90 days, held by our hosting provider and PostHog under their own retention settings |
| Ami conversation history and audit logs | 1 year, deleted automatically |
| Billing records | 7 years (required by tax law) |
| Data you export | Deleted manually 30 days after export |
Subprocessors
| Processor | Used for |
|---|---|
| Stripe | Billing |
| Maileroo | Transactional email |
| PostHog | Product analytics, error tracking and performance monitoring |
| Tag Manager and Analytics on the marketing site | |
| Cloudflare | Bot protection (Turnstile) on site forms and web analytics on the marketing site |
| The AI provider your workspace configures (e.g. Anthropic, OpenAI, Google Gemini, Groq) | AI responses for Ami |
| OpenAI (or the OpenAI-compatible endpoint a workspace admin configures) | Semantic search embeddings. Only when a workspace admin turns on semantic search; processes text chunks from policies, wiki pages, notes, tasks and Ami conversations, plus search questions. |
| Expo (650 Industries, Inc.) | Mobile push delivery: device push token, notification title and text, a notification ID and in-app link, relayed to Apple APNs / Google FCM |
| Cloud hosting provider | Application, database and file storage hosting |
Integrations you turn on — such as GreytHR attendance sync — only move data because you enabled them, and only for that purpose. Live service health is on our status page. Full detail: security, privacy policy, data processing addendum and terms of service.
Security questions buyers ask
Stop running your company on scattered tabs.
Get the AI-native operating system built to replace your stack — designed to get you running fast.