Security & data

What you hand us stays yours

You are going to give your agent documents, prices, sometimes access. Here is exactly what we do with them, and above all what we do not.

Dernière mise à jour : 11 août 2026

What we never do

Train an artificial intelligence model on your content.
Sell or rent your data, to anyone, in any form.
Read your conversations, unless you ask us to in order to fix something.
Drop an advertising tracker or a third-party analytics tool.
Merge one creator’s vault with someone else’s.

Your keys and your access

When you plug your agent into a tool, the key you hand over is encrypted before it is written to the database. It is decrypted only at the moment of the call, for that call, and never shown again in the clear: the interface only shows the last few characters.

You can revoke it at any time. Access granted by connecting a third-party service can also be withdrawn from that service, without going through us.

Who can read what

Your agents and their conversations are partitioned per account. A creator who publishes an agent does not see the conversations others have with their own copy, and a company plugging in a creator’s agent reaches neither its instructions nor its vault.

On the team side, every member has a role, and a read-only role gives no access to keys.

The foundations

Transport	HTTPS on every page and every call
Passwords	Hashed, never stored in the clear, never readable by us
Keys and access	Encrypted at rest, decrypted only at call time
Sessions	Signed token, automatic expiry, revoked on sign-out
Security & data	Railway Corporation

Who the data is entrusted to

Running the service requires providers. Each one steps in only for its own part, under contract.

Provider	Role	Location
Railway	Hébergement de l’application et de la base de données	Union européenne
Stripe	Encaissement des paiements et facturation	Irlande et États-Unis
Anthropic	Modèles de langage : génération des réponses des agents	États-Unis
OpenAI	Modèles de langage : génération des réponses des agents	États-Unis
Google	Modèles de langage, et connexion aux services Google que tu autorises	Union européenne et États-Unis
Resend	Envoi des e-mails transactionnels (vérification, invitations)	États-Unis
Twilio	Acheminement des messages WhatsApp et SMS, si tu actives ces canaux	Union européenne et États-Unis

If you use your own key with a model provider, the exchanges go straight to them, under your contract with them, and never touch our credits.

What stays your responsibility

When your agent talks to your customers, you are the controller of that processing and we are your processor. It is up to you to inform your customers, as for any form on your site, and not to hand your agent sensitive data without a legal basis. The detail is in the Privacy.

What people ask us about data

If I close my account, what happens to my data?

Your agents, your documents and your conversations are deleted. Only accounting records are kept, for ten years, because the law requires it.

Do my customers know they are talking to an agent?

Yes, and it is not negotiable: passing an agent off as a human being to someone who does not know is forbidden by our terms of use.

Where is the data hosted?

In the European Union. Language models run at their publishers, some of them in the United States: those transfers are covered by the Commission’s standard contractual clauses.

What happens in case of a breach?

We tell you and inform the CNIL within 72 hours, as the GDPR requires, saying what was affected and what you should do.

A question that is not here? Write to us.