How we keep your business safe.

• Your records live in a managed PostgreSQL database (Amazon RDS). It is encrypted at rest, has no public internet address, and its firewall only lets our own application servers connect. Connections to it must use an encrypted channel.
• Every storage bucket in our AWS account is encrypted at rest and blocks all public access. Documents you upload sit in a bucket that uses a dedicated encryption key service (AWS KMS). The working storage our website builder uses is encrypted too.
• Between your browser and SelfOperate, traffic is HTTPS only. Plain HTTP is redirected, the oldest accepted version is TLS 1.2, and browsers are told to keep using HTTPS for a year (HSTS).
• The site sends standard browser protections: it cannot be shown inside another site's frame, it blocks content-type guessing, and it limits where forms can post.
• A web application firewall in front of the site rate-limits abusive request patterns.
• Backups: the database takes an automatic backup every day and keeps it 7 days, with point-in-time recovery inside that window. Backups are encrypted and the database has deletion protection switched on. Restoring from a backup has been tested; we do not publish a recovery-time figure. Files you upload, and the files of websites we host for you, are versioned so an overwrite or delete can be undone.
• Isolation: your company's records are separated from other customers' by tenant and company checks on every read and write, and a request for another customer's records is answered as if it does not exist. All customers share one database; the separation is enforced in our software, not by a separate database for each person. Websites we host for you are served from a different domain from the app.
• Test and live are separate: our test environment has its own database, its own sign-in pool and its own secrets.
• Files you upload are scanned for malware before they can be used, and photos are checked for prohibited content before they are kept.
• Our AWS account records every administrative action (AWS CloudTrail, all regions, with tamper checks on the log files). Amazon GuardDuty threat detection watches the account for suspicious activity, and high-severity findings are emailed to us. Alarms notify us about server errors, failed health checks, a backed-up job queue, and database load or low disk. Application logs are kept 30 days.

• SPF: the domain lists exactly who may send for it, and tells receivers to reject everyone else.
• DKIM: our outgoing mail is cryptographically signed (Amazon SES), with a custom return path on our own domain.
• DMARC: published with a quarantine policy, applied to every failing message. Reports go to a mailbox we read.
• Bounces and complaints are suppressed automatically, so we stop writing to addresses that reject us.

• Main route: Anthropic's Claude models, run by Amazon Bedrock inside our AWS account. We use the United States routing profiles, so requests stay in the US.
• Backup route: the same Claude models through Microsoft Azure AI Foundry, used when Bedrock is busy or refuses a request.
• Pictures for websites and logo ideas are generated through fal.ai. Photos are checked for prohibited content by Amazon Rekognition. Research uses web search from Brave and Exa.
• Our practice: we do not sell your data or use it for advertising, and we do not use your business data to train general-purpose models for other customers.
• Digital employees start inside limits you set. Each task has its own setting: Off, suggest only, Ask me first, or Auto. Maya's first week is a practice week in which she drafts but sends nothing. Auto replies only start after that week.
• Digital employees never move money. Refunds, charges, payouts, payment requests, transfers, signing, filing, buying (including domains and ads), opening accounts, publishing your website and deleting your account are blocked for them in code and are always yours.
• Finances is read-only. Jordan works from payments you log and, if you connect Stripe, from a restricted key that can read balances and transactions and cannot write anything.
• Each digital employee has a spending ceiling that it cannot raise. Past the ceiling, the work pauses and asks you.

1. Spotting it: alarms watch the app for server errors, failed health checks, a backed-up job queue and database load, and notify us. Amazon GuardDuty watches the AWS account for suspicious activity and emails us about high-severity findings. Anything you report goes to a person.
2. Reporting it: write to the security address for a security problem, or to support for anything else. The support assistant always acknowledges security, privacy, legal and dispute messages and passes them to a person.
3. Reply time: we aim to reply within one business day, often sooner.
4. Fixing it: a person owns the fix. Application releases roll back automatically if the new version fails its health checks.
5. Money: refunds are the founder's decision, reviewed one by one.

We have not published a fixed timeline for telling affected owners about a data incident, so we do not promise one here.

• No SOC 2, ISO 27001, HIPAA or PCI certification or audit report for SelfOperate. The AWS and Stripe services we build on hold their own; ours are not covered by theirs.
• No independent penetration test of SelfOperate yet.
• We are a young company with a small team. The controls above are ones we run, not a promise of a particular outcome.