Your agency holds client trust. The architecture is built accordingly.
A dedicated database per customer, daily snapshots, a full export you can run yourself, and a role model that never leaks cost to the people who should not see it.
| Area | What is in place |
|---|---|
| Tenancy | Each customer workspace runs in its own Postgres database, provisioned for that workspace alone. Requests are pinned to their workspace by hostname before any query runs. A query with no workspace context is refused. |
| Backups | Daily point-in-time snapshots with retention, plus periodic logical dumps to object storage. Backup health is shown on your account page. Restores are operator-run and always preceded by a fresh snapshot. |
| Export and deletion | A complete JSON export of your workspace on demand from Settings, Account, Data. Deletion is scheduled with a 30-day grace period and can be cancelled during it. Backups roll off within 35 days after deletion. |
| Roles | Hours for members and managers. Budgets and revenue for account managers and directors. Cost, salary and margin for admins only. Enforced on every page, API and integration, including Claude. |
| Sign-in | Google sign-in only, bound to the Google account id rather than the email, so a changed address does not lose access and a re-used address cannot take one over. Admin impersonation is audited and cannot perform irreversible actions. |
| Secrets and payments | Database credentials are encrypted at rest and never logged or exported. Card details live with Stripe. Contact consent is recorded on every imported or captured contact. |
| Client-facing surfaces | Rate-limited, token-scoped share links for proposals, reports and the client portal. A content security policy and security headers on every response. Webhooks verify signatures and fail closed. |
| Audit log | Every write to settings, roles, billing, contracts and imports is recorded with who did it and when, visible to admins. Audit log export is included in the Scale plan. |
Questions
Where is my data stored?
In a dedicated Postgres database provisioned for your workspace alone, hosted on Neon in the United States region chosen at provisioning. Enterprise agreements can specify a dedicated region.
Can I export everything?
Yes. Settings, Account, Data produces a complete JSON export with credentials redacted, delivered by a single-use download link.
What happens to my data if I stop paying?
The workspace becomes read-only at the end of the paid period. If you delete it, the database is kept for a 30-day grace period before it is removed, and you can cancel the deletion during that time.
Do you complete security questionnaires?
Yes. We answer security questionnaires and walk through the architecture with your team as part of an Enterprise agreement.
Agency operating software
Run your agency on one system.
See the operating software that agencies built to scale themselves.
14-day trial. No card, no sales call. Your workspace is ready in a few minutes.